Supercell

supercell.com

Compare

https://supercell.com

Scanned Apr 15, 2026 · 39.3s

Your website score is

80/100
Good

Grade

B80

Banner

Yes

Regulatory Compliance

Multi-regulation overview — click any regulation for details

Technical scan only. A passing score does not equal legal compliance. Consult qualified legal counsel for your jurisdiction.

Tag Leak detected 2 user data leaks before consent on supercell.com.

Security Headers

0/6 present

Strict-Transport-Security

Add HSTS header to enforce HTTPS connections and prevent downgrade attacks

Content-Security-Policy

Add a Content-Security-Policy header to prevent XSS and code injection attacks

X-Frame-Options

Add X-Frame-Options header to prevent clickjacking attacks

X-Content-Type-Options

Set X-Content-Type-Options to 'nosniff' to prevent MIME type sniffing

Referrer-Policy

Set a Referrer-Policy header to control how much referrer information is shared

Permissions-Policy

Add a Permissions-Policy header to restrict browser features like camera, microphone, and geolocation

Google Consent Mode

V2
70/100
GTM Containers:GTM-N3484D8

Consent Parameters

ParameterDefaultUpdated
Ad Storagenot_setgranted
Ad User Datanot_setgranted
Ad Personalizationnot_setgranted
Analytics Storagenot_setgranted
Functionality Storagenot_setdenied
Personalization Storagenot_setgranted
Security Storagenot_setgranted

Issues (1)

No default consent call detected — consent mode may not be initialised correctly

Post-Rejection Audit

Reject Button

Found

Post-Rejection Fires

1 vendor

Consent Mode

Not Detected

GTM Load

After consent

Google Tag Manager(GTM-N3484D8)

Loaded after consent banner detected — no pre-consent IP transmission detected.

Consent Mode V2: Not Detected

Google Consent Mode was not detected on this site.

✓ gtag('consent', 'update') call detected on rejection

Vendors firing after rejection (1)

VendorCategoryTimingURL
Google — Google Tag Managertag_management17924mswww.googletagmanager.com

Consent Record Audit

Issues detected

Consent record stored after interaction

GDPR Art. 7(1)

Found: OptanonConsent (OneTrust)

Record contains timestamp

Art. 7(1)

Timestamp field detected

Record contains consent state

Art. 7(1)

Accept/reject state detected

Record contains consent categories

Art. 7(1)

Consent categories (analytics, marketing, etc.) not found in record

Consent withdrawal mechanism accessible

GDPR Art. 7(3)

No way for users to withdraw consent found on page

No cookie settings link, footer link, or floating consent button was detected. GDPR requires users to withdraw consent as easily as they gave it.

Why this matters

Under GDPR Article 7, controllers must be able to demonstrate that consent was given (Art. 7(1)) and ensure users can withdraw consent at any time, as easily as giving it (Art. 7(3)). Sites with no consent record or no withdrawal mechanism cannot legally rely on consent as a lawful basis.

Tracker categories detected

Analytics3 vendors
Security6
Tag Management2 vendors
Critical2
Google — Google Tag Manager
criticalPost-RejectionTag ManagementGoogle — Google Tag Manager

Google — Google Tag Manager fires after user rejected consent

Fired: 17924ms after load
criticalConsent Record

No recognizable consent withdrawal mechanism detected — GDPR Article 7(3) requires users can withdraw consent as easily as giving it (cookie settings link or floating button expected)

Warnings2
warningStorage

localStorage key "scsso_localstorage_test" written before consent

Key: scsso_localstorage_testType: localStorageFired: 1217ms after load
warningStorage

localStorage key "undefined" written before consent

Key: undefinedType: localStorageFired: 2228ms after load
Info4
Sentry
infoNetworkAnalyticsSentry

Sentry (Sentry) loaded before consent: Sentry error reporting endpoint

Host: o315582.ingest.sentry.ioFired: 2295ms after load
OneTrust
OneTrust2 findings

cdn.cookielaw.org, OptanonConsent

OneTrust
infoNetworkConsent MgmtOneTrust

OneTrust (OneTrust) loaded before consent: OneTrust cookie consent management

Host: cdn.cookielaw.orgFired: 2844ms after load
OneTrust
infoCookieConsent MgmtOneTrust

OneTrust cookie "OptanonConsent" set before consent

Cookie: OptanonConsentDomain: .supercell.com
OneTrust CMP
infoNetworkConsent MgmtOneTrust CMP

OneTrust CMP (OneTrust) loaded before consent: OneTrust geo-lookup — determines which consent banner to show based on user location

Host: geolocation.onetrust.comFired: 3062ms after load
Compliant7
Google Tag Manager
CompliantNetworkTag ManagementGoogle Tag Manager

Google Tag Manager (Google) loaded correctly after consent

ID: GTM-N3484D8Host: www.googletagmanager.comFired: 4105ms after load
OneTrust
CompliantCookieConsent MgmtOneTrust

OneTrust cookie "OptanonAlertBoxClosed" set correctly after consent

Cookie: OptanonAlertBoxClosedDomain: .supercell.com
Snowplow3 findings

_sp_ses.fbf6, _sp_id.fbf6, sp

CompliantCookieAnalyticsSnowplow

Snowplow cookie "_sp_ses.fbf6" set correctly after consent

Cookie: _sp_ses.fbf6Domain: .supercell.comRetention: 30 minutes
CompliantCookieAnalyticsSnowplow

Snowplow cookie "_sp_id.fbf6" set correctly after consent

Cookie: _sp_id.fbf6Domain: .supercell.comRetention: 2 years
CompliantCookieAnalyticsSnowplow

Snowplow cookie "sp" set correctly after consent

Cookie: spDomain: .supercell.comRetention: 1 year
Google Analytics
Google Analytics2 findings

_ga_VFRX0VPF8B, _ga

Google Analytics
CompliantCookieAnalyticsGoogle Analytics

Google Analytics cookie "_ga_VFRX0VPF8B" set correctly after consent

Cookie: _ga_VFRX0VPF8BDomain: .supercell.com
Google Analytics
CompliantCookieAnalyticsGoogle Analytics

Google Analytics cookie "_ga" set correctly after consent

Cookie: _gaDomain: .supercell.com

Is this your site?

Run a full multi-page scan with monitoring and get detailed remediation steps

Scan supercell.com →

This audit is based on publicly observable website behavior. To request removal from the index, email support@tagleak.com