← Keencrest cookie consent audits · PDF version

Keencrest cookie consent leak audit · Sample report: UK social agency, Civic Cookie Control. A real scan with the site's identity removed; not an audit commissioned by the site.

What uk-agency-d.example does before the visitor says yes

Page: https://uk-agency-d.example/ · scanned 2026-11-01 15:09 UTC · fresh browser, no clicks, 8 s wait

Trackers ran before consent: 5 vendor(s) that need opt-in consent loaded or set cookies before the visitor made any choice (6sense, Apollo.io website tracker, Google Analytics, Meta Pixel, X (Twitter) embed).

Consent banner detected: Civic Cookie Control (present, not visible). Google Consent Mode default: not set in dataLayer.

We found no reject or necessary-only button on the first layer of the banner, so the after-reject check was not run. The ICO and CNIL both expect rejecting to be as easy as accepting.

8cookies before consent

3third-party cookies

20third-party hosts contacted

5consent-requiring vendors

1. Before consent (no interaction)

Severity	Vendor	What it is	Evidence
high	6sense	Marketing automation / visitor ID	18 request(s) to b.6sc.co, c.6sc.co, ipv6.6sc.co, j.6sc.co cookies: 6suuid, _gd_session, _gd_svisitor, _gd_visitor
high	Apollo.io website tracker	Marketing automation / visitor ID	3 request(s) to aplo-evnt.com, assets.apollo.io
high	Google Analytics	Analytics	1 request(s) to www.google-analytics.com
high	Meta Pixel	Advertising / retargeting	3 request(s) to connect.facebook.net, www.facebook.com cookies: _fbp
high	X (Twitter) embed	Social / video embed	2 request(s) to platform.twitter.com
medium	Google Fonts (remote)	Data transfer to a third party (IP address)	12 request(s) to fonts.googleapis.com, fonts.gstatic.com
medium	Google Maps embed	Data transfer to a third party (IP address)	4 request(s) to maps.googleapis.com
medium	Google reCAPTCHA	Data transfer to a third party (IP address)	3 request(s) to www.google.com
medium	Instagram embed	Social / video embed	1 request(s) to platform.instagram.com Only the vendor's script was downloaded: no tracking hit and no cookie was seen in this scan. The vendor still received the visitor's IP address, and the tag may be waiting in a consent-hold mode; confirm it stays idle until consent.
info	Google Tag Manager / gtag.js	Tag manager (loads other tags)	3 request(s) to www.googletagmanager.com
ok	Civic Cookie Control	Consent banner	2 request(s) to apikeys.civiccomputing.com, cc.cdn.civiccomputing.com
ok	Load balancer / bot protection	Likely strictly necessary	cookies: __cf_bm

How to fix

6sense. Visitor-identification and marketing-automation scripts need prior consent. Gate them behind the marketing category.
Apollo.io website tracker. Visitor-identification and marketing-automation scripts need prior consent. Gate them behind the marketing category.
Google Analytics. Load GA4 only after consent: in GTM, give the GA4 tags an 'analytics_storage' consent requirement, or set Google Consent Mode v2 defaults to denied before gtag/GTM loads: gtag('consent','default',{ad_storage:'denied',analytics_storage:'denied',ad_user_data:'denied',ad_personalization:'denied'}). The CMP then sends the 'update' on accept.
Meta Pixel. Do not call fbq('init') before consent, or call fbq('consent','revoke') before init and fbq('consent','grant') from the CMP's accept callback. In GTM: marketing consent trigger only.
X (Twitter) embed. Embeds from social and video platforms set their own cookies. Use a click-to-load placeholder.
Google Fonts (remote). Self-host the fonts (download the files and serve them from your own domain). A German court (LG Munchen I, 2022) fined a site for sending visitor IPs to Google via remote Google Fonts.
Google Maps embed. Show a static map image or a click-to-load placeholder; load the interactive map only after consent.
Google reCAPTCHA. Load reCAPTCHA only on pages with a form, ideally when the form is focused, and name it in the privacy notice.
Instagram embed. Embeds from social and video platforms set their own cookies. Use a click-to-load placeholder.

General rule: set every tag's consent requirement in the tag manager, load the banner script first, and set Consent Mode defaults to denied before any Google tag. Re-scan after each change.

Cookies we could not classify

None.

Other third-party hosts contacted before consent

CDNs, fonts and APIs that are not on our tracker list. Usually harmless, listed so nothing is hidden.

2 other host(s): CDNs, fonts and APIs; names withheld in this public sample

localStorage keys written before consent

lastExternalReferrer, lastExternalReferrerTime, 67894192165e3103ee67b26e_eventQueue, 67894192165e3103ee67b26e_canTrack, apolloAnonId

Method and limits

One page, loaded in a fresh Chromium profile with no stored cookies. Before-consent figures cover the first 8 seconds with no click, scroll or mouse movement. Tags that wait for scrolling or a second page view are not seen.
Vantage point: this scan ran from an IP outside the EU/UK. Banners that geo-target (common with Cookiebot, OneTrust, Usercentrics) can behave differently for an EU visitor; a paid report is run from an EU vantage point or says it was not.
The browser identifies itself as Mozilla/5.0 (compatible; KeencrestConsentAudit/1.0; +https://keencrest-guides.web.app/cookie-consent-audit/). Sites that treat automated visitors differently may load fewer tags than they do for people.
Classification uses Keencrest's tracker list (built from each vendor's own cookie documentation; sources in the JSON). A vendor not on the list shows up under "unclassified", never silently dropped.
Severity reflects the general EU/UK rule (ePrivacy Directive Art. 5(3), UK PECR reg. 6, CJEU Planet49): storing or reading anything on the device that is not strictly necessary needs prior opt-in consent. Local rules differ (CNIL exempts some configured analytics).
This is a technical observation, not legal advice and not a compliance certificate. It cannot see the banner's wording, the privacy notice, server-side tracking or what happens after a visitor accepts.

Keencrest is an AI-run business owned by Alex Lin; this report was produced by automation.