https://verywellhealth.com
Scanned Apr 15, 2026 · 36.8s
Your website score is
Grade
BannerConsent Banner
Yes
Regulatory Compliance
Multi-regulation overview — click any regulation for details
Technical scan only. A passing score does not equal legal compliance. Consult qualified legal counsel for your jurisdiction.
Tag Leak detected 10 user data leaks before consent on verywellhealth.com, including Google (Tracker Tracker), GA4, Google Ads and 1 more.
Security Headers
4/6 presentStrict-Transport-Security
max-age=15552000
Content-Security-Policy
frame-ancestors 'self' https://*.seo.aws.about.com https://*.dotdash.com *.verywellhealth.com; upgrade-insecure-requests;
X-Frame-Options
Add X-Frame-Options header to prevent clickjacking attacks
X-Content-Type-Options
nosniff
Referrer-Policy
no-referrer-when-downgrade
Permissions-Policy
Add a Permissions-Policy header to restrict browser features like camera, microphone, and geolocation
Google Consent Mode
Not DetectedGoogle Consent Mode v2 was not found on this page. GCM v2 allows Google's tags to adjust their behavior based on user consent, and is required for compliant advertising measurement in the EU. Without it, your Google Ads and GA4 conversions may be impacted after consent is declined.
GTM container detected (GTM-5P3SZGS, GTM-WT6XGWDH) but no consent mode initialisation found. Add gtag('consent', 'default', ...) before your GTM snippet.
Post-Rejection Audit
Reject Button
Found
Post-Rejection Fires
3 vendors
Consent Mode
Basic
GTM Load
672ms pre-consent
Google Tag Manager(GTM-5P3SZGS)
Loaded 672ms after page load — before the consent banner was detected (banner appeared at 7358ms). Per a 2022 German court ruling, GTM itself transmits the user's IP to Google pre-consent.
Consent Mode V2: Basic
Basic Consent Mode — anonymised pings still fire after rejection. Permitted by Google but legally contested under PECR.
Vendors firing after rejection (3)
| Vendor | Category | Timing | URL |
|---|---|---|---|
| Sourcepoint — Sourcepoint CMP | consent_management | 16800ms | launchpad-wrapper.privacymanager.io |
| Google — GA4 | Basic CM ping | 17273ms | region1.google-analytics.com |
| Google — Google Ads | Basic CM ping | 18032ms | pagead2.googlesyndication.com |
Consent Record Audit
Issues detectedConsent record stored after interaction
GDPR Art. 7(1)Found: OptanonConsent (OneTrust)
Record contains timestamp
Art. 7(1)Timestamp field detected
Record contains consent state
Art. 7(1)Accept/reject state detected
Record contains consent categories
Art. 7(1)Consent categories (analytics, marketing, etc.) not found in record
Consent withdrawal mechanism accessible
GDPR Art. 7(3)No way for users to withdraw consent found on page
No cookie settings link, footer link, or floating consent button was detected. GDPR requires users to withdraw consent as easily as they gave it.
Why this matters
Under GDPR Article 7, controllers must be able to demonstrate that consent was given (Art. 7(1)) and ensure users can withdraw consent at any time, as easily as giving it (Art. 7(3)). Sites with no consent record or no withdrawal mechanism cannot legally rely on consent as a lawful basis.
Tracker categories detected
Critical8
Google Analytics4 findingsID trackedregion1.google-analytics.com, _ga, _ga_XMRMNPB3BJ, _ga_DK3GDWHWJH

region1.google-analytics.com, _ga, _ga_XMRMNPB3BJ, _ga_DK3GDWHWJH

GA4 (Google) loaded before consent: Sends pageview and event data to Google Analytics

Google Analytics cookie "_ga" set before consent

Google Analytics cookie "_ga_XMRMNPB3BJ" set before consent

Google Analytics cookie "_ga_DK3GDWHWJH" set before consent
Google (tracker) loaded before consent

Google Ads (Google) loaded before consent: Google ad syndication and remarketing
Sourcepoint — Sourcepoint CMP fires after user rejected consent
No recognizable consent withdrawal mechanism detected — GDPR Article 7(3) requires users can withdraw consent as easily as giving it (cookie settings link or floating button expected)
Warnings6
Google Tag Manager2 findingsID trackedwww.googletagmanager.com

www.googletagmanager.com

Google Tag Manager (Google) loaded before consent: Loads the GTM container which may trigger other tags

GTM loaded before consent banner — IP address transmitted to Google pre-consent (container: GTM-5P3SZGS)

Google — GA4 ping fires after rejection (Basic Consent Mode — anonymised, legal grey zone)

Google — Google Ads ping fires after rejection (Basic Consent Mode — anonymised, legal grey zone)
localStorage key "test" written before consent
localStorage key "~~~" written before consent
Info6
OneTrust2 findingscdn.cookielaw.org, OptanonConsent

cdn.cookielaw.org, OptanonConsent

OneTrust (OneTrust) loaded before consent: OneTrust cookie consent management

OneTrust cookie "OptanonConsent" set before consent

Cloudflare Web Analytics (Cloudflare) loaded before consent: Cloudflare Web Analytics beacon — privacy-focused, no cookies
Amazon (cdn) loaded before consent

Cloudflare cookie "_cfuvid" set before consent — The _cfuvid cookie is only set when a site uses this option in a Rate Limiting Rule, and is only used to allow the Cloudflare WAF to distinguish individual users who share the same IP address.
Cloudflare bot management — necessary for site operation
Compliant95
Criteo2 findingsstatic.criteo.net, cto_bundle

static.criteo.net, cto_bundle

Criteo (Criteo) loaded correctly after consent

Criteo cookie "cto_bundle" set correctly after consent
Sourcepoint CMP2 findingslaunchpad-wrapper.privacymanager.io, launchpad.privacymanager.io
launchpad-wrapper.privacymanager.io, launchpad.privacymanager.io
Sourcepoint CMP (Sourcepoint) loaded correctly after consent
Sourcepoint CMP (Sourcepoint) loaded correctly after consent
TripleLift2 findingssync, tluid
sync, tluid
TripleLift cookie "sync" set correctly after consent
TripleLift cookie "tluid" set correctly after consent
LiveIntent cookie "_li_ss" set correctly after consent

OneTrust cookie "OptanonAlertBoxClosed" set correctly after consent
openx.net2 findingsi, pd
i, pd
openx.net cookie "i" set correctly after consent
openx.net cookie "pd" set correctly after consent
Marfeel3 findings_sharedid, _sharedid_cst, _ssuma
_sharedid, _sharedid_cst, _ssuma
Marfeel cookie "_sharedid" set correctly after consent
Marfeel cookie "_sharedid_cst" set correctly after consent
Marfeel cookie "_ssuma" set correctly after consent
Adform4 findingsuid, cto_bidid, C, c

uid, cto_bidid, C, c

Adform cookie "uid" set correctly after consent

Adform cookie "cto_bidid" set correctly after consent

Adform cookie "C" set correctly after consent

Adform cookie "c" set correctly after consent
Yahoo2 findingsA3, IDSYNC
A3, IDSYNC
Yahoo cookie "A3" set correctly after consent
Yahoo cookie "IDSYNC" set correctly after consent
Chartbeat2 findings_chartbeat2, _chartbeat4
_chartbeat2, _chartbeat4
Chartbeat cookie "_chartbeat2" set correctly after consent
Chartbeat cookie "_chartbeat4" set correctly after consent
CreativeCDN cookie "g" set correctly after consent
PayPal cookie "ts" set correctly after consent
Google cookie "receive-cookie-deprecation" set correctly after consent
Lotame4 findings_cc_dc, _cc_id, panoramaId_expiry, panoramaId
_cc_dc, _cc_id, panoramaId_expiry, panoramaId
Lotame cookie "_cc_dc" set correctly after consent
Lotame cookie "_cc_id" set correctly after consent
Lotame cookie "panoramaId_expiry" set correctly after consent
Lotame cookie "panoramaId" set correctly after consent

Cloudflare cookie "__cf_bm" set correctly after consent
Beeswax2 findingsbito, bitoIsSecure
bito, bitoIsSecure
Beeswax cookie "bito" set correctly after consent
Beeswax cookie "bitoIsSecure" set correctly after consent
The Tradedesk2 findingsTDID, TDCPM
TDID, TDCPM
The Tradedesk cookie "TDID" set correctly after consent
The Tradedesk cookie "TDCPM" set correctly after consent
Amazon2 findingsad-id, ad-privacy
ad-id, ad-privacy
Amazon cookie "ad-id" set correctly after consent
Amazon cookie "ad-privacy" set correctly after consent
Admatic cookie "uids" set correctly after consent
Magnite4 findingskhaos, khaos_p, audit_p, audit
khaos, khaos_p, audit_p, audit
Magnite cookie "khaos" set correctly after consent
Magnite cookie "khaos_p" set correctly after consent
Magnite cookie "audit_p" set correctly after consent
Magnite cookie "audit" set correctly after consent
DoubleClick/Google Marketing2 findingsIDE, __gads

IDE, __gads

DoubleClick/Google Marketing cookie "IDE" set correctly after consent

DoubleClick/Google Marketing cookie "__gads" set correctly after consent
Google AdSense2 findings__gpi, __eoi

__gpi, __eoi

Google AdSense cookie "__gpi" set correctly after consent

Google AdSense cookie "__eoi" set correctly after consent
PubMatic19 findingsKADUSERCOOKIE, KRTBCOOKIE_80, KRTBCOOKIE_391, KRTBCOOKIE_632, KRTBCOOKIE_377, chkChromeAb67Sec, pi, DPSync4, SyncRTB4, KRTBCOOKIE_452, PugT, KRTBCOOKIE_153, KRTBCOOKIE_57, KRTBCOOKIE_945, KRTBCOOKIE_860, KRTBCOOKIE_466, KRTBCOOKIE_32, KRTBCOOKIE_188, SPugT
KADUSERCOOKIE, KRTBCOOKIE_80, KRTBCOOKIE_391, KRTBCOOKIE_632, KRTBCOOKIE_377, chkChromeAb67Sec, pi, DPSync4, SyncRTB4, KRTBCOOKIE_452, PugT, KRTBCOOKIE_153, KRTBCOOKIE_57, KRTBCOOKIE_945, KRTBCOOKIE_860, KRTBCOOKIE_466, KRTBCOOKIE_32, KRTBCOOKIE_188, SPugT
PubMatic cookie "KADUSERCOOKIE" set correctly after consent
PubMatic cookie "KRTBCOOKIE_80" set correctly after consent
PubMatic cookie "KRTBCOOKIE_391" set correctly after consent
PubMatic cookie "KRTBCOOKIE_632" set correctly after consent
PubMatic cookie "KRTBCOOKIE_377" set correctly after consent
PubMatic cookie "chkChromeAb67Sec" set correctly after consent
PubMatic cookie "pi" set correctly after consent
PubMatic cookie "DPSync4" set correctly after consent
PubMatic cookie "SyncRTB4" set correctly after consent
PubMatic cookie "KRTBCOOKIE_452" set correctly after consent
PubMatic cookie "PugT" set correctly after consent
PubMatic cookie "KRTBCOOKIE_153" set correctly after consent
PubMatic cookie "KRTBCOOKIE_57" set correctly after consent
PubMatic cookie "KRTBCOOKIE_945" set correctly after consent
PubMatic cookie "KRTBCOOKIE_860" set correctly after consent
PubMatic cookie "KRTBCOOKIE_466" set correctly after consent
PubMatic cookie "KRTBCOOKIE_32" set correctly after consent
PubMatic cookie "KRTBCOOKIE_188" set correctly after consent
PubMatic cookie "SPugT" set correctly after consent
1rx.io cookie "_rxuuid" set correctly after consent
Casale Media3 findingsCMID, CMPS, CMPRO
CMID, CMPS, CMPRO
Casale Media cookie "CMID" set correctly after consent
Casale Media cookie "CMPS" set correctly after consent
Casale Media cookie "CMPRO" set correctly after consent
ID53 findingsid5, gdpr, 3pi
id5, gdpr, 3pi
ID5 cookie "id5" set correctly after consent
ID5 cookie "gdpr" set correctly after consent
ID5 cookie "3pi" set correctly after consent

Quantcast cookie "mc" set correctly after consent
Xandr3 findingsXANDR_PANID, uuid2, anj
XANDR_PANID, uuid2, anj
Xandr cookie "XANDR_PANID" set correctly after consent
Xandr cookie "uuid2" set correctly after consent
Xandr cookie "anj" set correctly after consent
Federated Media Publishing cookie "ljt_reader" set correctly after consent
Platform161 cookie "tuuid" set correctly after consent
bidswitch.net cookie "tuuid_lu" set correctly after consent
Yieldmo cookie "yieldmo_id" set correctly after consent
SurveyMonkey cookie "re_sync" set correctly after consent
Outbrain cookie "obuid" set correctly after consent
NGINX Ingresss cookie "INGRESSCOOKIE" set correctly after consent
GumGum cookie "vst" set correctly after consent
csync.loopme.me cookie "viewer_token" set correctly after consent
Media.net2 findingsvisitor-id, data-pbs
visitor-id, data-pbs
Media.net cookie "visitor-id" set correctly after consent
Media.net cookie "data-pbs" set correctly after consent
Adobe Audience Manager2 findingsdemdex, dpm

demdex, dpm

Adobe Audience Manager cookie "demdex" set correctly after consent

Adobe Audience Manager cookie "dpm" set correctly after consent
Rapleaf2 findingsrlas3, pxrc
rlas3, pxrc
Rapleaf cookie "rlas3" set correctly after consent
Rapleaf cookie "pxrc" set correctly after consent
LinkedIn3 findingsbcookie, li_gc, lidc
bcookie, li_gc, lidc
LinkedIn cookie "bcookie" set correctly after consent
LinkedIn cookie "li_gc" set correctly after consent
LinkedIn cookie "lidc" set correctly after consent
Snowplow cookie "sp" set correctly after consent

Adobe Advertising cookie "everest_g_v2" set correctly after consent
localStorage availability probe (null) wrote "__storage_test__" to localStorage correctly after consent
Is this your site?
Run a full multi-page scan with monitoring and get detailed remediation steps
Scan verywellhealth.com →This audit is based on publicly observable website behavior. To request removal from the index, email support@tagleak.com