Target Cookie Compliance Report

Target

target.com

Compare

https://target.com

Scanned Apr 15, 2026 · 25.1s

Your website score is

0/100

Critical

Grade

BannerConsent Banner

Regulatory Compliance

Multi-regulation overview — click any regulation for details

Technical scan only. A passing score does not equal legal compliance. Consult qualified legal counsel for your jurisdiction.

Tag Leak detected 40 user data leaks before consent on target.com, including DoubleVerify (Tracker Tracker), Google (Tracker Tracker), HumanSecurity (Tracker Tracker) and 10 more.

Security Headers

5/6 present

Strict-Transport-Security

max-age=31536000; includeSubDomains

Content-Security-Policy

frame-ancestors 'self' https://*.target.com;

X-Frame-Options

SAMEORIGIN

X-Content-Type-Options

nosniff

Referrer-Policy

no-referrer-when-downgrade

Permissions-Policy

Add a Permissions-Policy header to restrict browser features like camera, microphone, and geolocation

Google Consent Mode

Not Detected

Google Consent Mode v2 was not found on this page. GCM v2 allows Google's tags to adjust their behavior based on user consent, and is required for compliant advertising measurement in the EU. Without it, your Google Ads and GA4 conversions may be impacted after consent is declined.

Post-Rejection Audit

Reject Button

Missing

Post-Rejection Fires

0 vendors

Consent Mode

Not Detected

GTM Load

Not detected

Consent Mode V2: Not Detected

Google Consent Mode was not detected on this site.

Consent Record Audit

Issues detected

Consent record stored after interaction

GDPR Art. 7(1)

No consent record written — cannot prove consent was given

No CMP consent cookie or localStorage entry was found after the consent interaction. GDPR requires controllers to demonstrate consent was given.

Consent withdrawal mechanism accessible

GDPR Art. 7(3)

No way for users to withdraw consent found on page

No cookie settings link, footer link, or floating consent button was detected. GDPR requires users to withdraw consent as easily as they gave it.

Why this matters

Under GDPR Article 7, controllers must be able to demonstrate that consent was given (Art. 7(1)) and ensure users can withdraw consent at any time, as easily as giving it (Art. 7(3)). Sites with no consent record or no withdrawal mechanism cannot legally rely on consent as a lawful basis.

Tracker categories detected

Advertising4 vendors

Analytics3 vendors

Marketing2 vendors

Security1 vendor

Critical33

DoubleVerify (Tracker Tracker)3 findings

pub.doubleverify.com, tps.doubleverify.com, tps-dn-ew1.doubleverify.com

criticalNetworkDoubleVerify (Tracker Tracker)

DoubleVerify (tracker) loaded before consent

Host: pub.doubleverify.comFired: 1102ms after load

criticalNetworkDoubleVerify (Tracker Tracker)

DoubleVerify (tracker) loaded before consent

Host: tps.doubleverify.comFired: 5132ms after load

criticalNetworkDoubleVerify (Tracker Tracker)

DoubleVerify (tracker) loaded before consent

Host: tps-dn-ew1.doubleverify.comFired: 5384ms after load

criticalNetworkGoogle (Tracker Tracker)

Google (tracker) loaded before consent

Host: securepubads.g.doubleclick.netFired: 1102ms after load

HumanSecurity (Tracker Tracker)3 findings

client.px-cloud.net, tzm.px-cloud.net, collector-pxgwpp4wus.px-cloud.net

criticalNetworkHumanSecurity (Tracker Tracker)

HumanSecurity (tracker) loaded before consent

Host: client.px-cloud.netFired: 1105ms after load

criticalNetworkHumanSecurity (Tracker Tracker)

HumanSecurity (tracker) loaded before consent

Host: tzm.px-cloud.netFired: 1637ms after load

criticalNetworkHumanSecurity (Tracker Tracker)

HumanSecurity (tracker) loaded before consent

Host: collector-pxgwpp4wus.px-cloud.netFired: 1654ms after load

Adobe (Tracker Tracker)3 findings

dpm.demdex.net, target.demdex.net, cm.everesttech.net

criticalNetworkAdobe (Tracker Tracker)

Adobe (tracker) loaded before consent

Host: dpm.demdex.netFired: 3076ms after load

criticalNetworkAdobe (Tracker Tracker)

Adobe (tracker) loaded before consent

Host: target.demdex.netFired: 3198ms after load

criticalNetworkAdobe (Tracker Tracker)

Adobe (tracker) loaded before consent

Host: cm.everesttech.netFired: 3206ms after load

FullStory3 findings

edge.fullstory.com, rs.fullstory.com, _fs_tab_id

criticalNetworkAnalyticsFullStory

FullStory (FullStory) loaded before consent: FullStory session recording and digital experience analytics

Host: edge.fullstory.comFired: 3183ms after load

criticalNetworkAnalyticsFullStory

FullStory (FullStory) loaded before consent: FullStory session recording and digital experience analytics

Host: rs.fullstory.comFired: 3249ms after load

criticalStorageAnalyticsFullStory

FullStory (FullStory) wrote "_fs_tab_id" to sessionStorage before consent

Key: _fs_tab_idType: sessionStorageFired: 3243ms after load

Advertising Tracker3 findings

vtrk.dv.tech, ponos.zeronaught.com, analytics-fe.digital-cloud.medallia.com

criticalNetworkAdvertisingAdvertising Tracker

advertising tracker at vtrk.dv.tech loaded before consent

Host: vtrk.dv.techFired: 3575ms after load

criticalNetworkAdvertisingAdvertising Tracker

advertising tracker at ponos.zeronaught.com loaded before consent

Host: ponos.zeronaught.comFired: 4762ms after load

criticalNetworkAdvertisingAdvertising Tracker

advertising tracker at analytics-fe.digital-cloud.medallia.com loaded before consent

Host: analytics-fe.digital-cloud.medallia.comFired: 5828ms after load

Google Ads3 findings

pagead2.googlesyndication.com, ba44f4afd91e4223cff6591b8215837c.safeframe.googlesyndication.com, tpc.googlesyndication.com

criticalNetworkAdvertisingGoogle Ads

Google Ads (Google) loaded before consent: Google ad syndication and remarketing

Host: pagead2.googlesyndication.comFired: 3646ms after load

criticalNetworkAdvertisingGoogle Ads

Google Ads (Google) loaded before consent: Google ad syndication and remarketing

Host: ba44f4afd91e4223cff6591b8215837c.safeframe.googlesyndication.comFired: 3686ms after load

criticalNetworkAdvertisingGoogle Ads

Google Ads (Google) loaded before consent: Google ad syndication and remarketing

Host: tpc.googlesyndication.comFired: 4129ms after load

DoubleVerify (Advertising Tracker)2 findings

pub.dv.tech, cdn.dv.tech

criticalNetworkAdvertisingDoubleVerify (Advertising Tracker)

DoubleVerify (advertising) loaded before consent

Host: pub.dv.techFired: 4129ms after load

criticalNetworkAdvertisingDoubleVerify (Advertising Tracker)

DoubleVerify (advertising) loaded before consent

Host: cdn.dv.techFired: 4752ms after load

criticalNetworkAnalyticsMedallia (Analytics Tracker)

Medallia (analytics) loaded before consent

Host: resources.digital-cloud.medallia.comFired: 5445ms after load

Google (Advertising Tracker)2 findings

ep1.adtrafficquality.google, ep2.adtrafficquality.google

criticalNetworkAdvertisingGoogle (Advertising Tracker)

Google (advertising) loaded before consent

Host: ep1.adtrafficquality.googleFired: 5446ms after load

criticalNetworkAdvertisingGoogle (Advertising Tracker)

Google (advertising) loaded before consent

Host: ep2.adtrafficquality.googleFired: 5549ms after load

Adobe Audience Manager3 findings

demdex, AMCVS_99DD1CFE5329660B0A490D45%40AdobeOrg, dpm

criticalCookieMarketingAdobe Audience Manager

Adobe Audience Manager cookie "demdex" set before consent — Unique value with which Audience Manager can identify a user. Used, among others, for identification, segmentation, modeling and reporting purposes.

Cookie: demdexDomain: .demdex.netRetention: 180 days after last activity or 10 years when opting out

criticalCookieMarketingAdobe Audience Manager

Adobe Audience Manager cookie "AMCVS_99DD1CFE5329660B0A490D45%40AdobeOrg" set before consent — The AMCVS cookie serves as a flag indicating that the session has been initialized. Its value is always 1 and discontinues when the session has ended.

Cookie: AMCVS_99DD1CFE5329660B0A490D45%40AdobeOrgDomain: .target.comRetention: Session

criticalCookieMarketingAdobe Audience Manager

Adobe Audience Manager cookie "dpm" set before consent — DPM is an abbreviation for Data Provider Match. It tells internal, Adobe systems that a call from Audience Manager or the Adobe Experience Cloud ID Service is passing in customer data for synchronization or requesting an ID.

Cookie: dpmDomain: .dpm.demdex.netRetention: 180 days

criticalCookieMarketingAdobe Advertising

Adobe Advertising cookie "everest_g_v2" set before consent — This cookie stores the browser and surfer ID.Created after a user initially clicks a client's ad, and used to map the current and subsequent clicks with other events on the client's website

Cookie: everest_g_v2Domain: .everesttech.netRetention: 2 years

criticalCookieAnalyticsAdobe Analytics

Adobe Analytics cookie "AMCV_99DD1CFE5329660B0A490D45%40AdobeOrg" set before consent

Cookie: AMCV_99DD1CFE5329660B0A490D45%40AdobeOrgDomain: .target.com

criticalNetwork

No consent banner detected — all cookies and tags fire without user consent

criticalConsent

No "reject all" option found — users cannot refuse non-essential cookies (ICO guidance requires this)

criticalConsent Record

No recognizable consent cookie or storage entry detected after interaction — GDPR Article 7(1) requires controllers to demonstrate consent was given (server-side storage cannot be verified)

criticalConsent Record

No recognizable consent withdrawal mechanism detected — GDPR Article 7(3) requires users can withdraw consent as easily as giving it (cookie settings link or floating button expected)

Warnings10

warningNetwork

Unknown third-party request to assets.targetimg1.com before consent

Host: assets.targetimg1.comFired: 1102ms after load

warningNetwork

Unknown third-party request to assets.adobedtm.com before consent

Host: assets.adobedtm.comFired: 2388ms after load

warningStorage

localStorage key "tk_1776280013345" written before consent

Key: tk_1776280013345Type: localStorageFired: 1612ms after load

warningStorage

sessionStorage key "tk_1776280013346" written before consent

Key: tk_1776280013346Type: sessionStorageFired: 1613ms after load

warningStorage

localStorage key "PXGWPp4wUS_px-ff" written before consent

Key: PXGWPp4wUS_px-ffType: localStorageFired: 1619ms after load

warningStorage

sessionStorage key "__test_key__" written before consent

Key: __test_key__Type: sessionStorageFired: 1820ms after load

warningStorage

localStorage key "PXGWPp4wUS_px_hvd" written before consent

Key: PXGWPp4wUS_px_hvdType: localStorageFired: 2071ms after load

warningStorage

sessionStorage key "pxsid" written before consent

Key: pxsidType: sessionStorageFired: 2073ms after load

warningStorage

localStorage key "FTzyeq12rr" written before consent

Key: FTzyeq12rrType: localStorageFired: 4329ms after load

warningStorage

localStorage key "l_FTzyeq12rr" written before consent

Key: l_FTzyeq12rrType: localStorageFired: 4329ms after load

Info2

infoNetworkAdobe (Cdn)

Adobe (cdn) loaded before consent

Host: target.scene7.comFired: 1136ms after load

infoCookieSecurityGoogle AdSense

Google AdSense cookie "__eoi" set before consent — This cookie is used for security authenticate users, prevent fraud, and protect users as they interact with a service.

Cookie: __eoiDomain: .target.comRetention: 3 Months

Is this your site?

Run a full multi-page scan with monitoring and get detailed remediation steps

Scan target.com →

This audit is based on publicly observable website behavior. To request removal from the index, email support@tagleak.com