Three

three.co.uk

Compare

https://three.co.uk

Scanned Apr 15, 2026 · 35.2s

Your website score is

5/100
Critical

Grade

F5

Banner

Yes

Regulatory Compliance

Multi-regulation overview — click any regulation for details

Technical scan only. A passing score does not equal legal compliance. Consult qualified legal counsel for your jurisdiction.

Tag Leak detected 62 user data leaks before consent on three.co.uk, including Advertising Tracker, GA4, Yext (Advertising Tracker) and 10 more.

Security Headers

4/6 present

Strict-Transport-Security

max-age=31536000 ; includeSubDomains ; preload

Content-Security-Policy

frame-ancestors 'self' apachearimlbvip.corpuk.net

X-Frame-Options

SAMEORIGIN

X-Content-Type-Options

nosniff

Referrer-Policy

Set a Referrer-Policy header to control how much referrer information is shared

Permissions-Policy

Add a Permissions-Policy header to restrict browser features like camera, microphone, and geolocation

Google Consent Mode

V2
95/100

Consent Parameters

ParameterDefaultUpdated
Ad Storagedeniedgranted
Ad User Datadeniedgranted
Ad Personalizationdeniedgranted
Analytics Storagedeniedgranted
Functionality Storagedeniedgranted
Personalization Storagenot_setnot_set
Security Storagegrantedgranted

Issues (1)

No GTM container detected — consent mode works best with Google Tag Manager

Post-Rejection Audit

Reject Button

Found

Post-Rejection Fires

0 vendors

Consent Mode

Not Detected

GTM Load

Not detected

Consent Mode V2: Not Detected

Google Consent Mode was not detected on this site.

✓ gtag('consent', 'update') call detected on rejection

No tracking vendors detected firing after rejection

Consent Record Audit

Pass

Consent record stored after interaction

GDPR Art. 7(1)

Found: OptanonConsent (OneTrust)

Record contains timestamp

Art. 7(1)

Timestamp field detected

Record contains consent state

Art. 7(1)

Accept/reject state detected

Record contains consent categories

Art. 7(1)

Consent categories (analytics, marketing, etc.) not found in record

Consent withdrawal mechanism accessible

GDPR Art. 7(3)

Cookie settings link / floating button found

Consent record and withdrawal mechanism are both correctly implemented

Tracker categories detected

Advertising6 vendors
Analytics8 vendors
Marketing6 vendors
Security2
Functional2 vendors
Critical21
Advertising Tracker
Advertising Tracker3 findings

rum.hlx.page, tracking.audio.thisisdax.com, lantern.roeye.com

Advertising Tracker
criticalNetworkAdvertisingAdvertising Tracker

advertising tracker at rum.hlx.page loaded before consent

Host: rum.hlx.pageFired: 87ms after load
Advertising Tracker
criticalNetworkAdvertisingAdvertising Tracker

advertising tracker at tracking.audio.thisisdax.com loaded before consent

Host: tracking.audio.thisisdax.comFired: 1539ms after load
Advertising Tracker
criticalNetworkAdvertisingAdvertising Tracker

advertising tracker at lantern.roeye.com loaded before consent

Host: lantern.roeye.comFired: 2254ms after load
Google Analytics
Google Analytics2 findings

www.googletagmanager.com, fpid

GA4
criticalNetworkAnalyticsGA4

GA4 loads before consent — this is expected and required for GCM v2 to initialise consent defaults before any tags fire

Host: www.googletagmanager.comFired: 470ms after load
Google Analytics
criticalCookieAnalyticsGoogle Analytics

Google Analytics cookie "fpid" set before consent — Registers statistical data on users' behaviour on the website. Used for internal analytics by the website operator.

Cookie: fpidDomain: .three.co.ukRetention: session
Yext (Advertising Tracker)
criticalNetworkAdvertisingYext (Advertising Tracker)

Yext (advertising) loaded before consent

Host: us.yextevents.comFired: 1500ms after load
Awin (Tracker Tracker)
criticalNetworkAwin (Tracker Tracker)

Awin (tracker) loaded before consent

Host: www.dwin1.comFired: 1578ms after load
OneTrust (Tracker Tracker)
criticalNetworkOneTrust (Tracker Tracker)

OneTrust (tracker) loaded before consent

Host: cdn-ukwest.onetrust.comFired: 1607ms after load
Acceleration Partners (Analytics Tracker)
criticalNetworkAnalyticsAcceleration Partners (Analytics Tracker)

Acceleration Partners (analytics) loaded before consent

Host: lantern.roeyecdn.comFired: 2098ms after load
Now Interact Nordic (Advertising Tracker)
Now Interact Nordic (Advertising Tracker)2 findings

cdn.nowinteract.com, imp3.nowinteract.com

Now Interact Nordic (Advertising Tracker)
criticalNetworkAdvertisingNow Interact Nordic (Advertising Tracker)

Now Interact Nordic (advertising) loaded before consent

Host: cdn.nowinteract.comFired: 2821ms after load
Now Interact Nordic (Advertising Tracker)
criticalNetworkAdvertisingNow Interact Nordic (Advertising Tracker)

Now Interact Nordic (advertising) loaded before consent

Host: imp3.nowinteract.comFired: 2900ms after load
PublicisGroupe (Tracker Tracker)
criticalNetworkPublicisGroupe (Tracker Tracker)

PublicisGroupe (tracker) loaded before consent

Host: login-ds.dotomi.comFired: 3714ms after load
New Relic (Analytics Tracker)
criticalNetworkAnalyticsNew Relic (Analytics Tracker)

New Relic (analytics) loaded before consent

Host: bam.eu01.nr-data.netFired: 4731ms after load
Dynatrace
Dynatrace5 findings

rxVisitor, dtSa, rxvt, dtPC, dtCookie

Dynatrace
criticalCookieAnalyticsDynatrace

Dynatrace cookie "rxVisitor" set before consent — This cookie is used by RUM API, Dynatrace Real User Monitoring (RUM) gives you the power to know your customers by providing performance analysis in real time.

Cookie: rxVisitorDomain: .three.co.ukRetention: Session
Dynatrace
criticalCookieAnalyticsDynatrace

Dynatrace cookie "dtSa" set before consent — This cookie is used by RUM API, Dynatrace Real User Monitoring (RUM) gives you the power to know your customers by providing performance analysis in real time.

Cookie: dtSaDomain: .three.co.ukRetention: Session
Dynatrace
criticalCookieAnalyticsDynatrace

Dynatrace cookie "rxvt" set before consent — This cookie is used by RUM API, Dynatrace Real User Monitoring (RUM) gives you the power to know your customers by providing performance analysis in real time.

Cookie: rxvtDomain: .three.co.ukRetention: Session
Dynatrace
criticalCookieAnalyticsDynatrace

Dynatrace cookie "dtPC" set before consent — This cookie is used by RUM API, Dynatrace Real User Monitoring (RUM) gives you the power to know your customers by providing performance analysis in real time.

Cookie: dtPCDomain: .three.co.ukRetention: Session
Dynatrace
criticalCookieAnalyticsDynatrace

Dynatrace cookie "dtCookie" set before consent — This cookie is used by RUM API, Dynatrace Real User Monitoring (RUM) gives you the power to know your customers by providing performance analysis in real time.

Cookie: dtCookieDomain: .three.co.ukRetention: Session
criticalCookieMarketingAwin

Awin cookie "lantern" set before consent — This cookie is used by the affiliate marketing platform AWIN to store a reference to a visit to attribute a sale to marketing channels.

Cookie: lanternDomain: .three.co.ukRetention: Awin
Adobe Analytics
Adobe Analytics2 findings

s_tp, s_ppv

Adobe Analytics
criticalCookieAnalyticsAdobe Analytics

Adobe Analytics cookie "s_tp" set before consent — This lets us know how much of the page you viewed.

Cookie: s_tpDomain: .three.co.ukRetention: session
Adobe Analytics
criticalCookieAnalyticsAdobe Analytics

Adobe Analytics cookie "s_ppv" set before consent — Stores information on the percentage of the page displayed

Cookie: s_ppvDomain: .three.co.ukRetention: session
Warnings41
Google Ads
warningNetworkAdvertisingGoogle Ads

Google Ads cookieless ping detected before consent — GCM v2 active with ad_storage and ad_user_data: denied. No user identifiers are collected in this request.

Host: pagead2.googlesyndication.comFired: 1090ms after load
Analytics proxy
warningNetworkAnalytics proxy

Possible server-side tag proxy at smetrics.three.co.uk — analytics data may be forwarded to third parties before consent. Browser scanning cannot verify downstream recipients; audit your GTM Server-side or CNAME configuration.

Host: smetrics.three.co.ukFired: 2176ms after load
vendor logo
warningNetwork

Unknown third-party request to assets.adobedtm.com before consent

Host: assets.adobedtm.comFired: 87ms after load
vendor logo
warningNetwork

Unknown third-party request to assets.sitescdn.net before consent

Host: assets.sitescdn.netFired: 92ms after load
vendor logo
warningNetwork

Unknown third-party request to ydn243.3gateway.net before consent

Host: ydn243.3gateway.netFired: 1090ms after load
vendor logo
warningNetwork

Unknown third-party request to three-resources.digital.medallia.eu before consent

Host: three-resources.digital.medallia.euFired: 2734ms after load
vendor logo
warningNetwork

Unknown third-party request to apps.euw2.pure.cloud before consent

Host: apps.euw2.pure.cloudFired: 2772ms after load
vendor logo
warningNetwork

Unknown third-party request to three-analytics.digital.medallia.eu before consent

Host: three-analytics.digital.medallia.euFired: 3302ms after load
vendor logo
warningNetwork

Unknown third-party request to api-cdn.euw2.pure.cloud before consent

Host: api-cdn.euw2.pure.cloudFired: 3668ms after load
vendor logo
warningNetwork

Unknown third-party request to api.euw2.pure.cloud before consent

Host: api.euw2.pure.cloudFired: 4369ms after load
warningStorage

sessionStorage key "com.adobe.reactor.core.visitorTracking.landingPage" written before consent

Key: com.adobe.reactor.core.visitorTracking.landingPageType: sessionStorageFired: 273ms after load
warningStorage

sessionStorage key "com.adobe.reactor.core.visitorTracking.trafficSource" written before consent

Key: com.adobe.reactor.core.visitorTracking.trafficSourceType: sessionStorageFired: 274ms after load
warningStorage

sessionStorage key "com.adobe.reactor.dataElements.Platform" written before consent

Key: com.adobe.reactor.dataElements.PlatformType: sessionStorageFired: 333ms after load
warningStorage

sessionStorage key "threeCurrentPageNavigationTitle" written before consent

Key: threeCurrentPageNavigationTitleType: sessionStorageFired: 627ms after load
warningStorage

sessionStorage key "threeCurrentPageUrl" written before consent

Key: threeCurrentPageUrlType: sessionStorageFired: 627ms after load
warningStorage

localStorage key "orderByPhoneNumberPages" written before consent

Key: orderByPhoneNumberPagesType: localStorageFired: 666ms after load
warningStorage

localStorage key "previousPageName" written before consent

Key: previousPageNameType: localStorageFired: 676ms after load
warningStorage

sessionStorage key "medallia_ref" written before consent

Key: medallia_refType: sessionStorageFired: 1045ms after load
warningStorage

sessionStorage key "rxVisitor" written before consent

Key: rxVisitorType: sessionStorageFired: 1372ms after load
warningStorage

sessionStorage key "rxvisitid" written before consent

Key: rxvisitidType: sessionStorageFired: 1373ms after load
warningStorage

sessionStorage key "rxvt" written before consent

Key: rxvtType: sessionStorageFired: 1374ms after load
warningStorage

sessionStorage key "dtSa" written before consent

Key: dtSaType: sessionStorageFired: 1386ms after load
warningStorage

localStorage key "com.adobe.reactor.dataElements.OnetrustActiveGroups" written before consent

Key: com.adobe.reactor.dataElements.OnetrustActiveGroupsType: localStorageFired: 1997ms after load
warningStorage

localStorage key "typeOfSubscription" written before consent

Key: typeOfSubscriptionType: localStorageFired: 2157ms after load
warningStorage

sessionStorage key "com.adobe.reactor.dataElements.Digital Data - User typeOfSubscription" written before consent

Key: com.adobe.reactor.dataElements.Digital Data - User typeOfSubscriptionType: sessionStorageFired: 2157ms after load
warningStorage

sessionStorage key "com.adobe.reactor.dataElements.Customer ID" written before consent

Key: com.adobe.reactor.dataElements.Customer IDType: sessionStorageFired: 2158ms after load
warningStorage

sessionStorage key "com.adobe.reactor.dataElements.Contact ID" written before consent

Key: com.adobe.reactor.dataElements.Contact IDType: sessionStorageFired: 2159ms after load
warningStorage

localStorage key "MSISDN" written before consent

Key: MSISDNType: localStorageFired: 2160ms after load
warningStorage

sessionStorage key "com.adobe.reactor.dataElements.MSISDN" written before consent

Key: com.adobe.reactor.dataElements.MSISDNType: sessionStorageFired: 2160ms after load
warningStorage

localStorage key "ni_imp_tc" written before consent

Key: ni_imp_tcType: localStorageFired: 2885ms after load
warningStorage

sessionStorage key "ni_imp_tn" written before consent

Key: ni_imp_tnType: sessionStorageFired: 2885ms after load
warningStorage

localStorage key "imp_uk" written before consent

Key: imp_ukType: localStorageFired: 2886ms after load
warningStorage

localStorage key "ni_imp_lprp" written before consent

Key: ni_imp_lprpType: localStorageFired: 3318ms after load
warningStorage

sessionStorage key "idh" written before consent

Key: idhType: sessionStorageFired: 3673ms after load
warningStorage

localStorage key "_c3006abd-3d00-496a-bdc5-04a01a054347:actmu" written before consent

Key: _c3006abd-3d00-496a-bdc5-04a01a054347:actmuType: localStorageFired: 4214ms after load
warningStorage

localStorage key "_c3006abd-3d00-496a-bdc5-04a01a054347:actms" written before consent

Key: _c3006abd-3d00-496a-bdc5-04a01a054347:actmsType: localStorageFired: 4214ms after load
warningStorage

localStorage key "_c3006abd-3d00-496a-bdc5-04a01a054347:actts" written before consent

Key: _c3006abd-3d00-496a-bdc5-04a01a054347:acttsType: localStorageFired: 4215ms after load
warningStorage

localStorage key "_c3006abd-3d00-496a-bdc5-04a01a054347:actvc" written before consent

Key: _c3006abd-3d00-496a-bdc5-04a01a054347:actvcType: localStorageFired: 4215ms after load
warningStorage

localStorage key "_c3006abd-3d00-496a-bdc5-04a01a054347:actsc" written before consent

Key: _c3006abd-3d00-496a-bdc5-04a01a054347:actscType: localStorageFired: 4348ms after load
warningStorage

localStorage key "_c3006abd-3d00-496a-bdc5-04a01a054347:actec" written before consent

Key: _c3006abd-3d00-496a-bdc5-04a01a054347:actecType: localStorageFired: 4349ms after load
warningStorage

localStorage key "_act_custom857e4260-3905-11f1-9f8f-79b1f339999c" written before consent

Key: _act_custom857e4260-3905-11f1-9f8f-79b1f339999cType: localStorageFired: 4355ms after load
Info8
Amazon (Cdn)
infoNetworkAmazon (Cdn)

Amazon (cdn) loaded before consent

Host: d2n6wm51p2b0jo.cloudfront.netFired: 1514ms after load
OneTrust CMP
infoNetworkConsent MgmtOneTrust CMP

OneTrust CMP (OneTrust) loaded before consent: OneTrust geo-lookup — determines which consent banner to show based on user location

Host: geolocation.onetrust.comFired: 1748ms after load
New Relic
infoNetworkAnalyticsNew Relic

New Relic (New Relic) loaded before consent: New Relic browser monitoring agent

Host: js-agent.newrelic.comFired: 4688ms after load
Azure / Microsoft
Azure / Microsoft2 findings

ApplicationGatewayAffinityCORS, ApplicationGatewayAffinity

Azure / Microsoft
infoCookieFunctionalAzure / Microsoft

Azure / Microsoft cookie "ApplicationGatewayAffinityCORS" set before consent — This cookie is used by Azure Apps to keep a user session on the same server.

Cookie: ApplicationGatewayAffinityCORSDomain: www.three.co.ukRetention: Session
Azure / Microsoft
infoCookieFunctionalAzure / Microsoft

Azure / Microsoft cookie "ApplicationGatewayAffinity" set before consent — This cookie is used by Azure Apps to keep a user session on the same server.

Cookie: ApplicationGatewayAffinityDomain: www.three.co.ukRetention: Session
OneTrust
infoCookieConsent MgmtOneTrust

OneTrust cookie "OptanonConsent" set before consent

Cookie: OptanonConsentDomain: .three.co.uk
infoCookieFunctional

Akamai bot management session — necessary for site protection

Cookie: ak_bmscDomain: .three.co.uk
infoCookieFunctional

Cloudflare bot management — necessary for site operation

Cookie: __cf_bmDomain: .sitescdn.net
Compliant26
Google Ads
Google Ads4 findings

www.google.com, googleads.g.doubleclick.net, _gcl_au, _gcl_ls

Google Ads
CompliantNetworkAdvertisingGoogle Ads

Google Ads (Google) loaded correctly after consent

Host: www.google.comFired: 1064ms after load
Google Ads
CompliantNetworkAdvertisingGoogle Ads

Google Ads (Google) loaded correctly after consent

Host: googleads.g.doubleclick.netFired: 1322ms after load
Google Ads
CompliantCookieAdvertisingGoogle Ads

Google Ads cookie "_gcl_au" set correctly after consent

Cookie: _gcl_auDomain: .three.co.uk
Google Ads
CompliantStorageAdvertisingGoogle Ads

Google Ads (Google) wrote "_gcl_ls" to localStorage correctly after consent

Key: _gcl_lsType: localStorageFired: -22846ms after load
Twitter/X Pixel
CompliantNetworkAdvertisingTwitter/X Pixel

Twitter/X Pixel (X (Twitter)) loaded correctly after consent

Host: static.ads-twitter.comFired: 2327ms after load
Microsoft Ads
Microsoft Ads3 findings

bat.bing.com, _uetsid, _uetvid

Microsoft Ads
CompliantNetworkAdvertisingMicrosoft Ads

Microsoft Ads (Microsoft) loaded correctly after consent

Host: bat.bing.comFired: 2373ms after load
Microsoft Ads
CompliantCookieAdvertisingMicrosoft Ads

Microsoft Ads cookie "_uetsid" set correctly after consent

Cookie: _uetsidDomain: .three.co.uk
Microsoft Ads
CompliantCookieAdvertisingMicrosoft Ads

Microsoft Ads cookie "_uetvid" set correctly after consent

Cookie: _uetvidDomain: .three.co.uk
OneTrust
CompliantCookieConsent MgmtOneTrust

OneTrust cookie "OptanonAlertBoxClosed" set correctly after consent

Cookie: OptanonAlertBoxClosedDomain: .three.co.uk
DoubleClick/Google Marketing
DoubleClick/Google Marketing2 findings

test_cookie, IDE

DoubleClick/Google Marketing
CompliantCookieFunctionalDoubleClick/Google Marketing

DoubleClick/Google Marketing cookie "test_cookie" set correctly after consent

Cookie: test_cookieDomain: .doubleclick.netRetention: 1 year
DoubleClick/Google Marketing
CompliantCookieMarketingDoubleClick/Google Marketing

DoubleClick/Google Marketing cookie "IDE" set correctly after consent

Cookie: IDEDomain: .doubleclick.netRetention: 2 years
CompliantCookieMarketingThe Tradedesk

The Tradedesk cookie "TDID" set correctly after consent

Cookie: TDIDDomain: .adsrvr.orgRetention: 1 year
X5 findings

guest_id_marketing, guest_id_ads, personalization_id, guest_id, muc_ads

CompliantCookieMarketingX

X cookie "guest_id_marketing" set correctly after consent

Cookie: guest_id_marketingDomain: .twitter.comRetention: 2 years
CompliantCookieMarketingX

X cookie "guest_id_ads" set correctly after consent

Cookie: guest_id_adsDomain: .twitter.comRetention: 2 years
CompliantCookieMarketingX

X cookie "personalization_id" set correctly after consent

Cookie: personalization_idDomain: .twitter.comRetention: 2 years
CompliantCookieMarketingX

X cookie "guest_id" set correctly after consent

Cookie: guest_idDomain: .twitter.comRetention: 2 years
CompliantCookieMarketingX

X cookie "muc_ads" set correctly after consent

Cookie: muc_adsDomain: .t.coRetention: 24 months
Adalyser.com4 findings

__adal_ses, __adal_id, __adal_ca, __adal_cw

CompliantCookieMarketingAdalyser.com

Adalyser.com cookie "__adal_ses" set correctly after consent

Cookie: __adal_sesDomain: .three.co.ukRetention: session
CompliantCookieMarketingAdalyser.com

Adalyser.com cookie "__adal_id" set correctly after consent

Cookie: __adal_idDomain: .three.co.ukRetention: 2 years
CompliantCookieMarketingAdalyser.com

Adalyser.com cookie "__adal_ca" set correctly after consent

Cookie: __adal_caDomain: .three.co.ukRetention: 6 months
CompliantCookieMarketingAdalyser.com

Adalyser.com cookie "__adal_cw" set correctly after consent

Cookie: __adal_cwDomain: .three.co.ukRetention: 7 days
Bing / Microsoft
CompliantCookieMarketingBing / Microsoft

Bing / Microsoft cookie "MUID" set correctly after consent

Cookie: MUIDDomain: .bing.comRetention: 1 year
ContentSquare
ContentSquare4 findings

_cs_c, _cs_cvars, _cs_id, _cs_s

ContentSquare
CompliantCookieAnalyticsContentSquare

ContentSquare cookie "_cs_c" set correctly after consent

Cookie: _cs_cDomain: .three.co.ukRetention: 13 months
ContentSquare
CompliantCookieAnalyticsContentSquare

ContentSquare cookie "_cs_cvars" set correctly after consent

Cookie: _cs_cvarsDomain: .three.co.ukRetention: Session
ContentSquare
CompliantCookieAnalyticsContentSquare

ContentSquare cookie "_cs_id" set correctly after consent

Cookie: _cs_idDomain: .three.co.ukRetention: 13 months
ContentSquare
CompliantCookieAnalyticsContentSquare

ContentSquare cookie "_cs_s" set correctly after consent

Cookie: _cs_sDomain: .three.co.ukRetention: 1 Year

Is this your site?

Run a full multi-page scan with monitoring and get detailed remediation steps

Scan three.co.uk →

This audit is based on publicly observable website behavior. To request removal from the index, email support@tagleak.com