Victoria's Secret

victoriassecret.com

Compare

Geo-redirect detected

https://victoriassecret.com redirected to https://nl.victoriassecret.com/nl/.

https://victoriassecret.com

Scanned Apr 15, 2026 · 39.7s

Your website score is

0/100
Critical

Grade

F0

Banner

Yes

Regulatory Compliance

Multi-regulation overview — click any regulation for details

Technical scan only. A passing score does not equal legal compliance. Consult qualified legal counsel for your jurisdiction.

Tag Leak detected 47 user data leaks before consent on victoriassecret.com, including Meta Pixel, Adobe (Tracker Tracker), Microsoft Ads and 9 more.

Security Headers

2/6 present

Strict-Transport-Security

max-age=31536000; includeSubDomains

Content-Security-Policy

Add a Content-Security-Policy header to prevent XSS and code injection attacks

X-Frame-Options

SAMEORIGIN

X-Content-Type-Options

Set X-Content-Type-Options to 'nosniff' to prevent MIME type sniffing

Referrer-Policy

Set a Referrer-Policy header to control how much referrer information is shared

Permissions-Policy

Add a Permissions-Policy header to restrict browser features like camera, microphone, and geolocation

Google Consent Mode

V2
65/100

Consent Parameters

ParameterDefaultUpdated
Ad Storagenot_setgranted
Ad User Datanot_setgranted
Ad Personalizationnot_setgranted
Analytics Storagenot_setgranted
Functionality Storagenot_setdenied
Personalization Storagenot_setgranted
Security Storagenot_setgranted

Issues (2)

No default consent call detected — consent mode may not be initialised correctly

No GTM container detected — consent mode works best with Google Tag Manager

Post-Rejection Audit

Reject Button

Found

Post-Rejection Fires

0 vendors

Consent Mode

Not Detected

GTM Load

Not detected

Consent Mode V2: Not Detected

Google Consent Mode was not detected on this site.

✓ gtag('consent', 'update') call detected on rejection

No tracking vendors detected firing after rejection

Consent Record Audit

Issues detected

Consent record stored after interaction

GDPR Art. 7(1)

Found: CookieConsentPolicy (Cookiebot)

Record contains timestamp

Art. 7(1)

No timestamp found in consent record

Record contains consent state

Art. 7(1)

Consent state (accepted/rejected) not found in record

Record contains consent categories

Art. 7(1)

Consent categories (analytics, marketing, etc.) not found in record

Consent withdrawal mechanism accessible

GDPR Art. 7(3)

No way for users to withdraw consent found on page

No cookie settings link, footer link, or floating consent button was detected. GDPR requires users to withdraw consent as easily as they gave it.

Why this matters

Under GDPR Article 7, controllers must be able to demonstrate that consent was given (Art. 7(1)) and ensure users can withdraw consent at any time, as easily as giving it (Art. 7(3)). Sites with no consent record or no withdrawal mechanism cannot legally rely on consent as a lawful basis.

Tracker categories detected

Advertising4 vendors
Analytics3 vendors
Marketing6 vendors
Security4
Functional4 vendors
Critical21
Meta Pixel
Meta Pixel3 findingsID tracked

www.facebook.com, connect.facebook.net, _fbp

Meta Pixel
criticalNetworkAdvertisingMeta Pixel

Meta Pixel (Meta) loaded before consent: Meta Pixel tracking endpoint

ID: 439439406264366Host: www.facebook.comFired: 7355ms after load
Meta Pixel
criticalNetworkAdvertisingMeta Pixel

Meta Pixel (Meta) loaded before consent: Sends user data to Meta for ad targeting and conversion tracking

Host: connect.facebook.netFired: 6518ms after load
Meta Pixel
criticalCookieAdvertisingMeta Pixel

Meta Pixel cookie "_fbp" set before consent

Cookie: _fbpDomain: .victoriassecret.com
Adobe (Tracker Tracker)
criticalNetworkAdobe (Tracker Tracker)

Adobe (tracker) loaded before consent

Host: adobedc.demdex.netFired: 6518ms after load
Microsoft Ads
Microsoft Ads3 findings

bat.bing.com, _uetsid, _uetvid

Microsoft Ads
criticalNetworkAdvertisingMicrosoft Ads

Microsoft Ads (Microsoft) loaded before consent: Microsoft Ads (Bing) UET conversion tracking

Host: bat.bing.comFired: 7355ms after load
Microsoft Ads
criticalCookieAdvertisingMicrosoft Ads

Microsoft Ads cookie "_uetsid" set before consent

Cookie: _uetsidDomain: .victoriassecret.com
Microsoft Ads
criticalCookieAdvertisingMicrosoft Ads

Microsoft Ads cookie "_uetvid" set before consent

Cookie: _uetvidDomain: .victoriassecret.com
GA4
criticalNetworkAnalyticsGA4

GA4 (Google) loaded before consent: Google Analytics gtag.js library

Host: www.googletagmanager.comFired: 7370ms after load
Pinterest Tag
criticalNetworkAdvertisingPinterest Tag

Pinterest Tag (Pinterest) loaded before consent: Pinterest tag script loader

Host: s.pinimg.comFired: 7724ms after load
Google (Tracker Tracker)
Google (Tracker Tracker)2 findings

ad.doubleclick.net, 4168207.fls.doubleclick.net

Google (Tracker Tracker)
criticalNetworkGoogle (Tracker Tracker)

Google (tracker) loaded before consent

Host: ad.doubleclick.netFired: 7725ms after load
Google (Tracker Tracker)
criticalNetworkGoogle (Tracker Tracker)

Google (tracker) loaded before consent

Host: 4168207.fls.doubleclick.netFired: 7742ms after load
Google Ads
Google Ads2 findings

www.google.com, _gcl_ls

Google Ads
criticalNetworkAdvertisingGoogle Ads

Google Ads (Google) loaded before consent: Google Consent Mode data collection for ad measurement

Host: www.google.comFired: 7770ms after load
Google Ads
criticalStorageAdvertisingGoogle Ads

Google Ads (Google) wrote "_gcl_ls" to localStorage before consent

Key: _gcl_lsType: localStorageFired: 7627ms after load
criticalCookieMarketingX

X cookie "auth_token" set before consent — These cookies enable us to track visitor activity from our X ads on our website, and also to allow users to share content from our websites. They cookies do not provide us with any confidential information relating to your account.

Cookie: auth_tokenDomain: .victoriassecret.comRetention: 2 years
Adform
criticalCookieMarketingAdform

Adform cookie "UID" set before consent — Contains a unique ID to identify a user

Cookie: UIDDomain: .victoriassecret.comRetention: 60 days
Adobe Audience Manager
criticalCookieMarketingAdobe Audience Manager

Adobe Audience Manager cookie "demdex" set before consent — Unique value with which Audience Manager can identify a user. Used, among others, for identification, segmentation, modeling and reporting purposes.

Cookie: demdexDomain: .demdex.netRetention: 180 days after last activity or 10 years when opting out
Adobe Analytics
Adobe Analytics3 findings

AMCV_17AE582658A4D7F70A495D43%40AdobeOrg, s_tp, s_ppv

Adobe Analytics
criticalCookieAnalyticsAdobe Analytics

Adobe Analytics cookie "AMCV_17AE582658A4D7F70A495D43%40AdobeOrg" set before consent

Cookie: AMCV_17AE582658A4D7F70A495D43%40AdobeOrgDomain: .victoriassecret.com
Adobe Analytics
criticalCookieAnalyticsAdobe Analytics

Adobe Analytics cookie "s_tp" set before consent — This lets us know how much of the page you viewed.

Cookie: s_tpDomain: .victoriassecret.comRetention: session
Adobe Analytics
criticalCookieAnalyticsAdobe Analytics

Adobe Analytics cookie "s_ppv" set before consent — Stores information on the percentage of the page displayed

Cookie: s_ppvDomain: .victoriassecret.comRetention: session
Bing / Microsoft
criticalCookieMarketingBing / Microsoft

Bing / Microsoft cookie "MUID" set before consent — Identifies unique web browsers visiting Microsoft sites. These cookies are used for advertising, site analytics, and other operational purposes.

Cookie: MUIDDomain: .bing.comRetention: 1 year
criticalConsent Record

No recognizable consent withdrawal mechanism detected — GDPR Article 7(3) requires users can withdraw consent as easily as giving it (cookie settings link or floating button expected)

Warnings27
Analytics proxy
warningNetworkAnalytics proxy

Possible server-side tag proxy at metrics.victoriassecret.com — analytics data may be forwarded to third parties before consent. Browser scanning cannot verify downstream recipients; audit your GTM Server-side or CNAME configuration.

Host: metrics.victoriassecret.comFired: 7066ms after load
vendor logo
warningNetwork

Unknown third-party request to api.likeshop.me before consent

Host: api.likeshop.meFired: 4510ms after load
vendor logo
warningNetwork

Unknown third-party request to api.radar.io before consent

Host: api.radar.ioFired: 4552ms after load
vendor logo
warningNetwork

Unknown third-party request to vscocustomercare.my.site.com before consent

Host: vscocustomercare.my.site.comFired: 4720ms after load
vendor logo
warningNetwork

Unknown third-party request to vscocustomercare.my.salesforce-scrt.com before consent

Host: vscocustomercare.my.salesforce-scrt.comFired: 4720ms after load
vendor logo
warningNetwork

Unknown third-party request to likeshop.me before consent

Host: likeshop.meFired: 5242ms after load
vendor logo
warningNetwork

Unknown third-party request to images.dashsocial.com before consent

Host: images.dashsocial.comFired: 5242ms after load
vendor logo
warningNetwork

Unknown third-party request to assets.adobedtm.com before consent

Host: assets.adobedtm.comFired: 6283ms after load
warningStorage

sessionStorage key "rum-random-id" written before consent

Key: rum-random-idType: sessionStorageFired: 1202ms after load
warningStorage

localStorage key "currentPageUrl" written before consent

Key: currentPageUrlType: localStorageFired: 2787ms after load
warningStorage

localStorage key "currentPageTemplate" written before consent

Key: currentPageTemplateType: localStorageFired: 2787ms after load
warningStorage

sessionStorage key "_st_storage_enabled_check" written before consent

Key: _st_storage_enabled_checkType: sessionStorageFired: 3834ms after load
warningStorage

localStorage key "fe6665dc9ebdd93a4dbba3195269d29cfd7ab85c0f036b3208fb2e08947b7ba0" written before consent

Key: fe6665dc9ebdd93a4dbba3195269d29cfd7ab85c0f036b3208fb2e08947b7ba0Type: localStorageFired: 3866ms after load
warningStorage

sessionStorage key "pos_tid" written before consent

Key: pos_tidType: sessionStorageFired: 3933ms after load
warningStorage

sessionStorage key "pos_ct" written before consent

Key: pos_ctType: sessionStorageFired: 3934ms after load
warningStorage

localStorage key "radar-deviceId" written before consent

Key: radar-deviceIdType: localStorageFired: 4128ms after load
warningStorage

localStorage key "radar-installId" written before consent

Key: radar-installIdType: localStorageFired: 4128ms after load
warningStorage

localStorage key "radar-sessionId" written before consent

Key: radar-sessionIdType: localStorageFired: 4128ms after load
warningStorage

localStorage key "00D3h000002soJh_WEB_STORAGE" written before consent

Key: 00D3h000002soJh_WEB_STORAGEType: localStorageFired: 5683ms after load
warningStorage

sessionStorage key "com.adobe.reactor.core.visitorTracking.landingPage" written before consent

Key: com.adobe.reactor.core.visitorTracking.landingPageType: sessionStorageFired: 6393ms after load
warningStorage

sessionStorage key "com.adobe.reactor.core.visitorTracking.trafficSource" written before consent

Key: com.adobe.reactor.core.visitorTracking.trafficSourceType: sessionStorageFired: 6394ms after load
warningStorage

localStorage key "lastExternalReferrer" written before consent

Key: lastExternalReferrerType: localStorageFired: 6710ms after load
warningStorage

sessionStorage key "com.adobe.alloy.17AE582658A4D7F70A495D43@AdobeOrgclickData" written before consent

Key: com.adobe.alloy.17AE582658A4D7F70A495D43@AdobeOrgclickDataType: sessionStorageFired: 7033ms after load
warningStorage

localStorage key "_uetsid" written before consent

Key: _uetsidType: localStorageFired: 7473ms after load
warningStorage

localStorage key "_uetsid_exp" written before consent

Key: _uetsid_expType: localStorageFired: 7474ms after load
warningStorage

localStorage key "_uetvid" written before consent

Key: _uetvidType: localStorageFired: 7476ms after load
warningStorage

localStorage key "_uetvid_exp" written before consent

Key: _uetvid_expType: localStorageFired: 7476ms after load
Info10
Sentry
infoNetworkAnalyticsSentry

Sentry (Sentry) loaded before consent: Sentry error reporting endpoint

Host: o4509050836680704.ingest.us.sentry.ioFired: 1549ms after load
OneTrust
OneTrust2 findings

cdn.cookielaw.org, OptanonConsent

OneTrust
infoNetworkConsent MgmtOneTrust

OneTrust (OneTrust) loaded before consent: OneTrust cookie consent management

Host: cdn.cookielaw.orgFired: 2897ms after load
OneTrust
infoCookieConsent MgmtOneTrust

OneTrust cookie "OptanonConsent" set before consent

Cookie: OptanonConsentDomain: .victoriassecret.com
OneTrust CMP
infoNetworkConsent MgmtOneTrust CMP

OneTrust CMP (OneTrust) loaded before consent: OneTrust geo-lookup — determines which consent banner to show based on user location

Host: geolocation.onetrust.comFired: 5129ms after load
CloudFlare
infoCookieFunctionalCloudFlare

CloudFlare cookie "__cfwaitingroom" set before consent — The __cfwaitingroom cookie is only used to track visitors that access a waiting room enabled host and path combination for a zone. Visitors using a browser that does not accept cookies cannot visit the host and path combination while the waiting room is active.

Cookie: __cfwaitingroomDomain: .www.victoriassecret.comRetention: session
Salesforce
Salesforce2 findings

CookieConsentPolicy, renderCtx

Salesforce
infoCookieFunctionalSalesforce

Salesforce cookie "CookieConsentPolicy" set before consent — Used to apply end-user cookie consent preferences set by our client-side utility.

Cookie: CookieConsentPolicyDomain: .victoriassecret.comRetention: 1 year
Salesforce
infoCookieFunctionalSalesforce

Salesforce cookie "renderCtx" set before consent — Used to deliver requested pages and content based on a user's navigation.

Cookie: renderCtxDomain: .victoriassecret.comRetention: session
infoStorageFunctionallocalStorage availability probe

localStorage availability probe (null) wrote "__storage_test__" to localStorage before consent

Key: __storage_test__Type: localStorageFired: 1191ms after load
infoCookieFunctional

Cloudflare bot management — necessary for site operation

Cookie: __cf_bmDomain: .victoriassecret.com
infoCookieFunctional

AWS Application Load Balancer — necessary for infrastructure

Cookie: AWSALBTGCORSDomain: likeshop.me
Compliant7
Google Ads
CompliantCookieAdvertisingGoogle Ads

Google Ads cookie "_gcl_au" set correctly after consent

Cookie: _gcl_auDomain: .victoriassecret.com
DoubleClick/Google Marketing
DoubleClick/Google Marketing2 findings

IDE, ar_debug

DoubleClick/Google Marketing
CompliantCookieMarketingDoubleClick/Google Marketing

DoubleClick/Google Marketing cookie "IDE" set correctly after consent

Cookie: IDEDomain: .doubleclick.netRetention: 2 years
DoubleClick/Google Marketing
CompliantCookieMarketingDoubleClick/Google Marketing

DoubleClick/Google Marketing cookie "ar_debug" set correctly after consent

Cookie: ar_debugDomain: .pinterest.comRetention: Persistent
Pinterest Tag
CompliantCookieAdvertisingPinterest Tag

Pinterest Tag cookie "_pin_unauth" set correctly after consent

Cookie: _pin_unauthDomain: .nl.victoriassecret.com
Pinterest
CompliantCookieMarketingPinterest

Pinterest cookie "_pinterest_ct_ua" set correctly after consent

Cookie: _pinterest_ct_uaDomain: .ct.pinterest.comRetention: session
OneTrust
CompliantCookieConsent MgmtOneTrust

OneTrust cookie "OptanonAlertBoxClosed" set correctly after consent

Cookie: OptanonAlertBoxClosedDomain: .victoriassecret.com
Cloudflare
CompliantCookieFunctionalCloudflare

Cloudflare cookie "_cfuvid" set correctly after consent

Cookie: _cfuvidDomain: .victoriassecret.comRetention: session

Is this your site?

Run a full multi-page scan with monitoring and get detailed remediation steps

Scan victoriassecret.com →

This audit is based on publicly observable website behavior. To request removal from the index, email support@tagleak.com