← Keencrest cookie consent audits · PDF version

Keencrest cookie consent leak audit · Sample report: German digital agency, Usercentrics banner. A real scan with the site's identity removed; not an audit commissioned by the site.

What de-agency-e.example does before the visitor says yes

Page: https://de-agency-e.example/ · scanned 2026-11-01 15:09 UTC · fresh browser, no clicks, 8 s wait

No known tracker fired before consent on this page in this scan.

Consent banner detected: Usercentrics (present, not visible). Google Consent Mode default: not set in dataLayer.

We found no reject or necessary-only button on the first layer of the banner, so the after-reject check was not run. The ICO and CNIL both expect rejecting to be as easy as accepting.

2cookies before consent

2third-party cookies

11third-party hosts contacted

0consent-requiring vendors

1. Before consent (no interaction)

Severity	Vendor	What it is	Evidence
info	HubSpot forms	Functional third party	4 request(s) to forms-na1.hsforms.com, forms.hsforms.com, js.hsforms.net
ok	Load balancer / bot protection	Likely strictly necessary	cookies: __cf_bm
ok	Usercentrics	Consent banner	12 request(s) to app.usercentrics.eu, privacy-proxy.usercentrics.eu, web.cmp.usercentrics.eu

How to fix

Nothing to fix from the known-tracker list. Review the unclassified items below.

General rule: set every tag's consent requirement in the tag manager, load the banner script first, and set Consent Mode defaults to denied before any Google tag. Re-scan after each change.

Cookies we could not classify

None.

Other third-party hosts contacted before consent

CDNs, fonts and APIs that are not on our tracker list. Usually harmless, listed so nothing is hidden.

5 other host(s): CDNs, fonts and APIs; names withheld in this public sample

localStorage keys written before consent

ucData, ucString

Method and limits

One page, loaded in a fresh Chromium profile with no stored cookies. Before-consent figures cover the first 8 seconds with no click, scroll or mouse movement. Tags that wait for scrolling or a second page view are not seen.
Vantage point: this scan ran from an IP outside the EU/UK. Banners that geo-target (common with Cookiebot, OneTrust, Usercentrics) can behave differently for an EU visitor; a paid report is run from an EU vantage point or says it was not.
The browser identifies itself as Mozilla/5.0 (compatible; KeencrestConsentAudit/1.0; +https://keencrest-guides.web.app/cookie-consent-audit/). Sites that treat automated visitors differently may load fewer tags than they do for people.
Classification uses Keencrest's tracker list (built from each vendor's own cookie documentation; sources in the JSON). A vendor not on the list shows up under "unclassified", never silently dropped.
Severity reflects the general EU/UK rule (ePrivacy Directive Art. 5(3), UK PECR reg. 6, CJEU Planet49): storing or reading anything on the device that is not strictly necessary needs prior opt-in consent. Local rules differ (CNIL exempts some configured analytics).
This is a technical observation, not legal advice and not a compliance certificate. It cannot see the banner's wording, the privacy notice, server-side tracking or what happens after a visitor accepts.

Keencrest is an AI-run business owned by Alex Lin; this report was produced by automation.