Starbucks Cookie Compliance Report

Starbucks

starbucks.com

Compare

https://starbucks.com

Scanned Apr 15, 2026 · 28.0s

Your website score is

0/100

Critical

Grade

BannerConsent Banner

Yes

Regulatory Compliance

Multi-regulation overview — click any regulation for details

Technical scan only. A passing score does not equal legal compliance. Consult qualified legal counsel for your jurisdiction.

Tag Leak detected 41 user data leaks before consent on starbucks.com, including Optimizely, TrustARC (Tracker Tracker), Google Ads and 12 more.

Security Headers

3/6 present

Strict-Transport-Security

max-age=31536000; includeSubDomains; preload

Content-Security-Policy

default-src 'self' *.starbucks.com *.starbucks.ca; child-src 'self' *.starbucks.com *.starbucks.ca *.doubleclick.net *.optimizely.com *.trustarc.com; connect-src 'self' *.starbucks.com *.starbucks.ca https://fonts.gstatic.com *.akamaihd.net *.akstat.io *.doubleclick.net *.go-mpulse.net *.google.com *.google-analytics.com *.googletagmanager.com *.googlevideo.com *.mparticle.com *.nr-data.net *.optimizely.com *.pinterest.com *.trustarc.com *.xg4ken.com; font-src 'self' *.starbucks.com *.starbucks.ca https://fonts.googleapis.com https://fonts.gstatic.com *.trustarc.com; img-src 'self' data: *.starbucks.com *.starbucks.ca https://*.gstatic.com *.adsrvr.org *.agkn.com *.akamaihd.net *.appcast.io *.bing.com *.doubleclick.net *.facebook.com *.ggpht.com *.google.com *.google-analytics.com *.googletagmanager.com *.mparticle.com *.nr-data.net *.pinterest.com *.snapchat.com *.trustarc.com *.truste.com *.videoamp.com *.xg4ken.com *.ytimg.com; manifest-src 'self' *.starbucks.com *.starbucks.ca; media-src 'self' blob: *.starbucks.com *.starbucks.ca *.youtube.com; frame-src 'self' *.googletagmanager.com *.optimizely.com *.trustarc.com *.youtube.com; frame-ancestors 'none'; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.starbucks.com *.starbucks.ca cdnjs.com *.appcast.io *.bing.com *.doubleclick.net *.facebook.net *.go-mpulse.net *.google.com *.google-analytics.com *.googletagmanager.com *.gstatic.com *.mparticle.com *.newrelic.com *.nr-data.net *.optimizely.com *.pinimg.com *.sc-static.net *.snapchat.com *.trustarc.com *.xg4ken.com; style-src 'self' 'unsafe-inline' *.starbucks.com *.starbucks.ca https://fonts.googleapis.com;

X-Frame-Options

Add X-Frame-Options header to prevent clickjacking attacks

X-Content-Type-Options

nosniff

Referrer-Policy

Set a Referrer-Policy header to control how much referrer information is shared

Permissions-Policy

Add a Permissions-Policy header to restrict browser features like camera, microphone, and geolocation

Google Consent Mode

55/100

GTM Containers:GTM-P37KWTP

Consent Parameters

ParameterDefaultUpdated

Ad Storagenot_setnot_set

Ad User Datanot_setnot_set

Ad Personalizationnot_setnot_set

Analytics Storagenot_setnot_set

Functionality Storagenot_setnot_set

Personalization Storagenot_setnot_set

Security Storagenot_setnot_set

Issues (2)

No default consent call detected — consent mode may not be initialised correctly

Google Consent Mode v1 detected — upgrade to v2 (requires ad_user_data and ad_personalization parameters)

Post-Rejection Audit

Reject Button

Missing

Post-Rejection Fires

0 vendors

Consent Mode

Not Detected

GTM Load

1137ms pre-consent

Google Tag Manager(GTM-P37KWTP)

Loaded 1137ms after page load — before the consent banner was detected (banner appeared at 7596ms). Per a 2022 German court ruling, GTM itself transmits the user's IP to Google pre-consent.

Consent Mode V2: Not Detected

Google Consent Mode was not detected on this site.

Consent Record Audit

Issues detected

Consent record stored after interaction

GDPR Art. 7(1)

No consent record written — cannot prove consent was given

No CMP consent cookie or localStorage entry was found after the consent interaction. GDPR requires controllers to demonstrate consent was given.

Consent withdrawal mechanism accessible

GDPR Art. 7(3)

No way for users to withdraw consent found on page

No cookie settings link, footer link, or floating consent button was detected. GDPR requires users to withdraw consent as easily as they gave it.

Why this matters

Under GDPR Article 7, controllers must be able to demonstrate that consent was given (Art. 7(1)) and ensure users can withdraw consent at any time, as easily as giving it (Art. 7(3)). Sites with no consent record or no withdrawal mechanism cannot legally rely on consent as a lawful basis.

Tracker categories detected

Advertising4 vendors

Analytics6 vendors

Marketing5 vendors

Security3

Functional1

Tag Management1 vendor

Critical27

criticalNetworkAdvertisingPinterest Tag

Pinterest Tag (Pinterest) loaded before consent: Pinterest conversion tracking

ID: 2614993994100Host: ct.pinterest.comFired: 1687ms after load

Google Analytics4 findingsID tracked

region1.google-analytics.com, _ga, _ga_VMTHZW7WSM, _ga_Q8JXK1T67J

criticalNetworkAnalyticsGA4

GA4 (Google) loaded before consent: Sends pageview and event data to Google Analytics

ID: G-VMTHZW7WSMHost: region1.google-analytics.comFired: 1809ms after load

criticalCookieAnalyticsGoogle Analytics

Google Analytics cookie "_ga" set before consent

Cookie: _gaDomain: .starbucks.com

criticalCookieAnalyticsGoogle Analytics

Google Analytics cookie "_ga_VMTHZW7WSM" set before consent

Cookie: _ga_VMTHZW7WSMDomain: .starbucks.com

criticalCookieAnalyticsGoogle Analytics

Google Analytics cookie "_ga_Q8JXK1T67J" set before consent

Cookie: _ga_Q8JXK1T67JDomain: .starbucks.com

Optimizely5 findings

cdn.optimizely.com, a6558036.cdn.optimizely.com, logx.optimizely.com, optimizelyEndUserId, optimizelyOptOut

criticalNetworkAnalyticsOptimizely

Optimizely (Optimizely) loaded before consent: Optimizely experimentation and A/B testing

Host: cdn.optimizely.comFired: 580ms after load

criticalNetworkAnalyticsOptimizely

Optimizely (Optimizely) loaded before consent: Optimizely experimentation and A/B testing

Host: a6558036.cdn.optimizely.comFired: 746ms after load

criticalNetworkAnalyticsOptimizely

Optimizely (Optimizely) loaded before consent: Optimizely event logging endpoint

Host: logx.optimizely.comFired: 1718ms after load

criticalCookieAnalyticsOptimizely

Optimizely cookie "optimizelyEndUserId" set before consent

Cookie: optimizelyEndUserIdDomain: .starbucks.com

criticalCookieMarketingOptimizely

Optimizely cookie "optimizelyOptOut" set before consent — Stores a boolean indicating whether the visitor has opted out of participating in Optimizely-powered experimentation.

Cookie: optimizelyOptOutDomain: .starbucks.comRetention: 10 years

criticalNetworkTrustARC (Tracker Tracker)

TrustARC (tracker) loaded before consent

Host: consent.trustarc.comFired: 582ms after load

Google Ads3 findings

www.google.com, _gcl_au, _gcl_ls

criticalNetworkAdvertisingGoogle Ads

Google Ads (Google) loaded before consent: Google Consent Mode data collection for ad measurement

Host: www.google.comFired: 1341ms after load

criticalCookieAdvertisingGoogle Ads

Google Ads cookie "_gcl_au" set before consent

Cookie: _gcl_auDomain: .starbucks.com

criticalStorageAdvertisingGoogle Ads

Google Ads (Google) wrote "_gcl_ls" to localStorage before consent

Key: _gcl_lsType: localStorageFired: 1322ms after load

criticalNetworkAnalyticsmParticle

mParticle (mParticle) loaded before consent: mParticle customer data platform

Host: jssdkcdns.mparticle.comFired: 1687ms after load

criticalNetworkAdvertisingSkai (Advertising Tracker)

Skai (advertising) loaded before consent

Host: resources.xg4ken.comFired: 1687ms after load

criticalNetworkAdvertisingTransUnion (Advertising Tracker)

TransUnion (advertising) loaded before consent

Host: d.agkn.comFired: 1687ms after load

Rokt (Analytics Tracker)2 findings

identity.mparticle.com, jssdks.mparticle.com

criticalNetworkAnalyticsRokt (Analytics Tracker)

Rokt (analytics) loaded before consent

Host: identity.mparticle.comFired: 1939ms after load

criticalNetworkAnalyticsRokt (Analytics Tracker)

Rokt (analytics) loaded before consent

Host: jssdks.mparticle.comFired: 2199ms after load

criticalNetworkThe Trade Desk (Tracker Tracker)

The Trade Desk (tracker) loaded before consent

Host: match.adsrvr.orgFired: 2237ms after load

criticalCookieMarketingDoubleClick/Google Marketing

DoubleClick/Google Marketing cookie "ar_debug" set before consent — Store and track conversions

Cookie: ar_debugDomain: .pinterest.comRetention: Persistent

criticalCookieMarketingPinterest

Pinterest cookie "_pinterest_ct_ua" set before consent — This cookieis a third party cookie which groups actions for users who cannot be identified by Pinterest.

Cookie: _pinterest_ct_uaDomain: .ct.pinterest.comRetention: session

criticalCookieMarketingNeustar

Neustar cookie "ab" set before consent — This cookie is used by the website’s operator in context with multi-variate testing. This is a tool used to combine or change content on the website. This allows the website to find the best variation/edition of the site.

Cookie: abDomain: .agkn.comRetention: 1 year

criticalCookieMarketingTotvs

Totvs cookie "u" set before consent — This cookie is Used for audience segmentation for advertising

Cookie: uDomain: .agkn.comRetention: 1 year

criticalConsent

No "reject all" option found — users cannot refuse non-essential cookies (ICO guidance requires this)

criticalConsent Record

No recognizable consent cookie or storage entry detected after interaction — GDPR Article 7(1) requires controllers to demonstrate consent was given (server-side storage cannot be verified)

criticalConsent Record

No recognizable consent withdrawal mechanism detected — GDPR Article 7(3) requires users can withdraw consent as easily as giving it (cookie settings link or floating button expected)

Warnings17

Google Tag Manager2 findingsID tracked

www.googletagmanager.com

warningNetworkTag ManagementGoogle Tag Manager

Google Tag Manager (Google) loaded before consent: Loads the GTM container which may trigger other tags

ID: GTM-P37KWTPHost: www.googletagmanager.comFired: 1020ms after load

warningGTMTag ManagementGoogle Tag Manager

GTM loaded before consent banner — IP address transmitted to Google pre-consent (container: GTM-P37KWTP)

warningConsentTrustArc

TrustArc was clicked but no consent storage was written — tags may continue firing as if consent was never given

warningStorage

localStorage key "optimizely_data$$oeu1776286368509r0.5171170052595775$$13849340212$$event_queue" written before consent

Key: optimizely_data$$oeu1776286368509r0.5171170052595775$$13849340212$$event_queueType: localStorageFired: 710ms after load

warningStorage

localStorage key "optimizely_data$$oeu1776286368509r0.5171170052595775$$13849340212$$tracker_optimizely" written before consent

Key: optimizely_data$$oeu1776286368509r0.5171170052595775$$13849340212$$tracker_optimizelyType: localStorageFired: 716ms after load

warningStorage

localStorage key "optimizely_data$$oeu1776286368509r0.5171170052595775$$13849340212$$layer_states" written before consent

Key: optimizely_data$$oeu1776286368509r0.5171170052595775$$13849340212$$layer_statesType: localStorageFired: 716ms after load

warningStorage

localStorage key "optimizely_data$$oeu1776286368509r0.5171170052595775$$13849340212$$session_state" written before consent

Key: optimizely_data$$oeu1776286368509r0.5171170052595775$$13849340212$$session_stateType: localStorageFired: 717ms after load

warningStorage

localStorage key "optimizely_data$$oeu1776286368509r0.5171170052595775$$13849340212$$visitor_profile" written before consent

Key: optimizely_data$$oeu1776286368509r0.5171170052595775$$13849340212$$visitor_profileType: localStorageFired: 717ms after load

warningStorage

localStorage key "optimizely_data$$oeu1776286368509r0.5171170052595775$$13849340212$$variation_map" written before consent

Key: optimizely_data$$oeu1776286368509r0.5171170052595775$$13849340212$$variation_mapType: localStorageFired: 717ms after load

warningStorage

localStorage key "optimizely_data$$oeu1776286368509r0.5171170052595775$$13849340212$$layer_map" written before consent

Key: optimizely_data$$oeu1776286368509r0.5171170052595775$$13849340212$$layer_mapType: localStorageFired: 717ms after load

warningStorage

localStorage key "optimizely_data$$oeu1776286368509r0.5171170052595775$$13849340212$$contextual_mab" written before consent

Key: optimizely_data$$oeu1776286368509r0.5171170052595775$$13849340212$$contextual_mabType: localStorageFired: 717ms after load

warningStorage

localStorage key "optimizely_data$$pending_events" written before consent

Key: optimizely_data$$pending_eventsType: localStorageFired: 1710ms after load

warningStorage

localStorage key "mparticle" written before consent

Key: mparticleType: localStorageFired: 1912ms after load

warningStorage

localStorage key "mprtcl-v4_0C9BECA0-id-cache" written before consent

Key: mprtcl-v4_0C9BECA0-id-cacheType: localStorageFired: 1915ms after load

warningStorage

localStorage key "mprtcl-v4_0C9BECA0" written before consent

Key: mprtcl-v4_0C9BECA0Type: localStorageFired: 1924ms after load

warningStorage

localStorage key "mprtcl-tos-0C9BECA0" written before consent

Key: mprtcl-tos-0C9BECA0Type: localStorageFired: 1933ms after load

warningStorage

sessionStorage key "mprtcl-v4_0C9BECA0-events" written before consent

Key: mprtcl-v4_0C9BECA0-eventsType: sessionStorageFired: 2159ms after load

Info3

New Relic2 findings

js-agent.newrelic.com, bam.nr-data.net

infoNetworkAnalyticsNew Relic

New Relic (New Relic) loaded before consent: New Relic browser monitoring agent

Host: js-agent.newrelic.comFired: 2334ms after load

infoNetworkAnalyticsNew Relic

New Relic (New Relic) loaded before consent: New Relic browser data collection endpoint

Host: bam.nr-data.netFired: 2364ms after load

infoCookieFunctional

Java session identifier — necessary for site operation

Cookie: JSESSIONIDDomain: .nr-data.net

Is this your site?

Run a full multi-page scan with monitoring and get detailed remediation steps

Scan starbucks.com →

This audit is based on publicly observable website behavior. To request removal from the index, email support@tagleak.com