← Keencrest cookie consent audits · PDF version

Keencrest cookie consent leak audit · Sample report: UK digital agency, Cookiebot banner. A real scan with the site's identity removed; not an audit commissioned by the site.

What uk-agency-a.example does before the visitor says yes

Page: https://uk-agency-a.example/ · scanned 2026-11-01 15:08 UTC · fresh browser, no clicks, 8 s wait

Trackers ran before consent: 5 vendor(s) that need opt-in consent loaded or set cookies before the visitor made any choice (Google Analytics, HubSpot analytics, HubSpot collected forms, LinkedIn, LinkedIn Insight Tag).

Consent banner detected: Cookiebot. Google Consent Mode default: not set in dataLayer.

After we clicked the banner's reject button (selector #CybotCookiebotDialogBodyButtonDecline) and reloaded: 4 consent-requiring vendor(s) still ran (HubSpot analytics, HubSpot collected forms, LinkedIn, LinkedIn Insight Tag). A reject that does not stop tracking is the most serious finding here.

21cookies before consent

21third-party cookies

20third-party hosts contacted

5consent-requiring vendors

1. Before consent (no interaction)

Severity	Vendor	What it is	Evidence
high	Google Analytics	Analytics	1 request(s) to www.google-analytics.com cookies: _ga, _ga_XXXXXXX
high	HubSpot analytics	Marketing automation / visitor ID	2 request(s) to js-eu1.hs-analytics.net, track-eu1.hubspot.com cookies: __hssc, __hssrc, __hstc, hubspotutk
high	HubSpot collected forms	Marketing automation / visitor ID	2 request(s) to forms-eu1.hscollectedforms.net, js-eu1.hscollectedforms.net
high	LinkedIn	Advertising / retargeting	cookies: AnalyticsSyncHistory, UserMatchHistory, bcookie, bscookie, li_sugr, lidc
high	LinkedIn Insight Tag	Advertising / retargeting	5 request(s) to px.ads.linkedin.com, snap.licdn.com
medium	HubSpot ads pixel	Advertising / retargeting	1 request(s) to js-eu1.hsadspixel.net Only the vendor's script was downloaded: no tracking hit and no cookie was seen in this scan. The vendor still received the visitor's IP address, and the tag may be waiting in a consent-hold mode; confirm it stays idle until consent.
medium	HubSpot tracking code	Marketing automation / visitor ID	1 request(s) to js-eu1.hs-scripts.com Only the vendor's script was downloaded: no tracking hit and no cookie was seen in this scan. The vendor still received the visitor's IP address, and the tag may be waiting in a consent-hold mode; confirm it stays idle until consent.
info	Google Tag Manager / gtag.js	Tag manager (loads other tags)	2 request(s) to www.googletagmanager.com
info	HubSpot forms	Functional third party	1 request(s) to perf-eu1.hsforms.com
ok	Consent banner (stores the choice)	Consent banner	cookies: CookieConsent
ok	Cookiebot	Consent banner	5 request(s) to consent.cookiebot.com, consentcdn.cookiebot.com
ok	HubSpot cookie banner	Consent banner	1 request(s) to js-eu1.hs-banner.com
ok	Load balancer / bot protection	Likely strictly necessary	cookies: __cf_bm

2. After rejecting, on the next page load

Severity	Vendor	What it is	Evidence
high	HubSpot analytics	Marketing automation / visitor ID	2 request(s) to js-eu1.hs-analytics.net, track-eu1.hubspot.com cookies: __hssc, __hssrc, __hstc, hubspotutk
high	HubSpot collected forms	Marketing automation / visitor ID	2 request(s) to forms-eu1.hscollectedforms.net, js-eu1.hscollectedforms.net
high	LinkedIn	Advertising / retargeting	cookies: AnalyticsSyncHistory (left over), UserMatchHistory (left over), bcookie, bscookie (left over), li_sugr, lidc (left over)
high	LinkedIn Insight Tag	Advertising / retargeting	4 request(s) to px.ads.linkedin.com, snap.licdn.com
medium	Google Analytics	Analytics	2 request(s) to www.google-analytics.com Consent Mode signal on hits: denied Google Consent Mode v2 in advanced mode: hits were sent with storage denied (cookieless pings). No cookie was set, but the request still reached Google before any choice; some EU regulators treat this as needing consent too.
medium	HubSpot ads pixel	Advertising / retargeting	1 request(s) to js-eu1.hsadspixel.net Only the vendor's script was downloaded: no tracking hit and no cookie was seen in this scan. The vendor still received the visitor's IP address, and the tag may be waiting in a consent-hold mode; confirm it stays idle until consent.
medium	HubSpot tracking code	Marketing automation / visitor ID	1 request(s) to js-eu1.hs-scripts.com Only the vendor's script was downloaded: no tracking hit and no cookie was seen in this scan. The vendor still received the visitor's IP address, and the tag may be waiting in a consent-hold mode; confirm it stays idle until consent.
info	Google Tag Manager / gtag.js	Tag manager (loads other tags)	2 request(s) to www.googletagmanager.com
info	HubSpot forms	Functional third party	1 request(s) to perf-eu1.hsforms.com
ok	Consent banner (stores the choice)	Consent banner	cookies: CookieConsent (left over)
ok	Cookiebot	Consent banner	5 request(s) to consent.cookiebot.com, consentcdn.cookiebot.com
ok	HubSpot cookie banner	Consent banner	1 request(s) to js-eu1.hs-banner.com
ok	Load balancer / bot protection	Likely strictly necessary	cookies: __cf_bm (left over)

How to fix

Google Analytics. Load GA4 only after consent: in GTM, give the GA4 tags an 'analytics_storage' consent requirement, or set Google Consent Mode v2 defaults to denied before gtag/GTM loads: gtag('consent','default',{ad_storage:'denied',analytics_storage:'denied',ad_user_data:'denied',ad_personalization:'denied'}). The CMP then sends the 'update' on accept.
HubSpot analytics. Turn on HubSpot's consent setting (Settings > Privacy & Consent > Cookies) or load js.hs-scripts.com only after consent.
HubSpot collected forms. Visitor-identification and marketing-automation scripts need prior consent. Gate them behind the marketing category.
LinkedIn. LinkedIn cookies came from the Insight Tag or an embed; gate both behind marketing consent or replace embeds with a click-to-load placeholder.
LinkedIn Insight Tag. Fire the Insight Tag only after marketing consent (GTM consent requirement or CMP category).
HubSpot ads pixel. Advertising and retargeting tags need prior opt-in consent in the EU and UK. Move them behind the marketing category of the consent banner.
HubSpot tracking code. HubSpot's code sets __hstc/hubspotutk on load unless its own cookie banner or 'Require consent' setting is on. Turn on HubSpot's consent banner setting or load the script from the CMP's marketing category.

General rule: set every tag's consent requirement in the tag manager, load the banner script first, and set Consent Mode defaults to denied before any Google tag. Re-scan after each change.

Cookies we could not classify

Not on our list. Each one is either strictly necessary (fine without consent) or needs to move behind the banner. Your developer should know which.

Cookie	Domain	Party	Expires in
`preferred-locale`	a third-party domain (withheld)	third	365 days

Other third-party hosts contacted before consent

CDNs, fonts and APIs that are not on our tracker list. Usually harmless, listed so nothing is hidden.

6 other host(s): CDNs, fonts and APIs; names withheld in this public sample

localStorage keys written before consent

li_adsId

Method and limits

One page, loaded in a fresh Chromium profile with no stored cookies. Before-consent figures cover the first 8 seconds with no click, scroll or mouse movement. Tags that wait for scrolling or a second page view are not seen.
Vantage point: this scan ran from an IP outside the EU/UK. Banners that geo-target (common with Cookiebot, OneTrust, Usercentrics) can behave differently for an EU visitor; a paid report is run from an EU vantage point or says it was not.
The browser identifies itself as Mozilla/5.0 (compatible; KeencrestConsentAudit/1.0; +https://keencrest-guides.web.app/cookie-consent-audit/). Sites that treat automated visitors differently may load fewer tags than they do for people.
Classification uses Keencrest's tracker list (built from each vendor's own cookie documentation; sources in the JSON). A vendor not on the list shows up under "unclassified", never silently dropped.
Severity reflects the general EU/UK rule (ePrivacy Directive Art. 5(3), UK PECR reg. 6, CJEU Planet49): storing or reading anything on the device that is not strictly necessary needs prior opt-in consent. Local rules differ (CNIL exempts some configured analytics).
This is a technical observation, not legal advice and not a compliance certificate. It cannot see the banner's wording, the privacy notice, server-side tracking or what happens after a visitor accepts.

Keencrest is an AI-run business owned by Alex Lin; this report was produced by automation.