← Keencrest cookie consent audits · PDF version

Keencrest cookie consent leak audit · Sample report: UK digital agency, Cookie-Script banner with Consent Mode. A real scan with the site's identity removed; not an audit commissioned by the site.

What uk-agency-c.example does before the visitor says yes

Page: https://uk-agency-c.example/ · scanned 2026-11-01 15:08 UTC · fresh browser, no clicks, 8 s wait

Trackers ran before consent: 2 vendor(s) that need opt-in consent loaded or set cookies before the visitor made any choice (HubSpot analytics, HubSpot collected forms).

Consent banner detected: Cookie-Script. Google Consent Mode default: {"ad_storage": "denied", "ad_user_data": "denied", "ad_personalization": "denied", "analytics_storage": "denied", "wait_for_update": 500}.

After we clicked the banner's reject button (selector #cookiescript_reject) and reloaded: 2 consent-requiring vendor(s) still ran (HubSpot analytics, HubSpot collected forms). A reject that does not stop tracking is the most serious finding here.

12cookies before consent

7third-party cookies

16third-party hosts contacted

2consent-requiring vendors

1. Before consent (no interaction)

Severity	Vendor	What it is	Evidence
high	HubSpot analytics	Marketing automation / visitor ID	3 request(s) to js-eu1.hs-analytics.net, track-eu1.hubspot.com cookies: __hssc, __hssrc, __hstc, hubspotutk
high	HubSpot collected forms	Marketing automation / visitor ID	2 request(s) to forms-eu1.hscollectedforms.net, js-eu1.hscollectedforms.net
medium	HubSpot ads pixel	Advertising / retargeting	1 request(s) to js-eu1.hsadspixel.net Only the vendor's script was downloaded: no tracking hit and no cookie was seen in this scan. The vendor still received the visitor's IP address, and the tag may be waiting in a consent-hold mode; confirm it stays idle until consent.
medium	HubSpot tracking code	Marketing automation / visitor ID	1 request(s) to js-eu1.hs-scripts.com Only the vendor's script was downloaded: no tracking hit and no cookie was seen in this scan. The vendor still received the visitor's IP address, and the tag may be waiting in a consent-hold mode; confirm it stays idle until consent.
info	Google Tag Manager / gtag.js	Tag manager (loads other tags)	1 request(s) to www.googletagmanager.com
info	HubSpot forms	Functional third party	7 request(s) to forms-eu1.hsforms.com, forms.hsforms.com, js-eu1.hsforms.net, perf-eu1.hsforms.com
ok	Consent banner (stores the choice)	Consent banner	cookies: CookieScriptConsent
ok	Cookie-Script	Consent banner	1 request(s) to cdn.cookie-script.com
ok	HubSpot cookie banner	Consent banner	1 request(s) to js-eu1.hs-banner.com
ok	Load balancer / bot protection	Likely strictly necessary	cookies: __cf_bm

2. After rejecting, on the next page load

Severity	Vendor	What it is	Evidence
high	HubSpot analytics	Marketing automation / visitor ID	3 request(s) to js-eu1.hs-analytics.net, track-eu1.hubspot.com
high	HubSpot collected forms	Marketing automation / visitor ID	2 request(s) to forms-eu1.hscollectedforms.net, js-eu1.hscollectedforms.net
medium	HubSpot ads pixel	Advertising / retargeting	1 request(s) to js-eu1.hsadspixel.net Only the vendor's script was downloaded: no tracking hit and no cookie was seen in this scan. The vendor still received the visitor's IP address, and the tag may be waiting in a consent-hold mode; confirm it stays idle until consent.
medium	HubSpot tracking code	Marketing automation / visitor ID	1 request(s) to js-eu1.hs-scripts.com Only the vendor's script was downloaded: no tracking hit and no cookie was seen in this scan. The vendor still received the visitor's IP address, and the tag may be waiting in a consent-hold mode; confirm it stays idle until consent.
info	Google Tag Manager / gtag.js	Tag manager (loads other tags)	1 request(s) to www.googletagmanager.com
info	HubSpot forms	Functional third party	7 request(s) to forms-eu1.hsforms.com, forms.hsforms.com, js-eu1.hsforms.net, perf-eu1.hsforms.com
ok	Consent banner (stores the choice)	Consent banner	cookies: CookieScriptConsent (left over)
ok	Cookie-Script	Consent banner	1 request(s) to cdn.cookie-script.com
ok	HubSpot cookie banner	Consent banner	1 request(s) to js-eu1.hs-banner.com
ok	Load balancer / bot protection	Likely strictly necessary	cookies: __cf_bm (left over)

How to fix

HubSpot analytics. Turn on HubSpot's consent setting (Settings > Privacy & Consent > Cookies) or load js.hs-scripts.com only after consent.
HubSpot collected forms. Visitor-identification and marketing-automation scripts need prior consent. Gate them behind the marketing category.
HubSpot ads pixel. Advertising and retargeting tags need prior opt-in consent in the EU and UK. Move them behind the marketing category of the consent banner.
HubSpot tracking code. HubSpot's code sets __hstc/hubspotutk on load unless its own cookie banner or 'Require consent' setting is on. Turn on HubSpot's consent banner setting or load the script from the CMP's marketing category.

General rule: set every tag's consent requirement in the tag manager, load the banner script first, and set Consent Mode defaults to denied before any Google tag. Re-scan after each change.

Cookies we could not classify

None.

Other third-party hosts contacted before consent

CDNs, fonts and APIs that are not on our tracker list. Usually harmless, listed so nothing is hidden.

3 other host(s): CDNs, fonts and APIs; names withheld in this public sample

Method and limits

One page, loaded in a fresh Chromium profile with no stored cookies. Before-consent figures cover the first 8 seconds with no click, scroll or mouse movement. Tags that wait for scrolling or a second page view are not seen.
Vantage point: this scan ran from an IP outside the EU/UK. Banners that geo-target (common with Cookiebot, OneTrust, Usercentrics) can behave differently for an EU visitor; a paid report is run from an EU vantage point or says it was not.
The browser identifies itself as Mozilla/5.0 (compatible; KeencrestConsentAudit/1.0; +https://keencrest-guides.web.app/cookie-consent-audit/). Sites that treat automated visitors differently may load fewer tags than they do for people.
Classification uses Keencrest's tracker list (built from each vendor's own cookie documentation; sources in the JSON). A vendor not on the list shows up under "unclassified", never silently dropped.
Severity reflects the general EU/UK rule (ePrivacy Directive Art. 5(3), UK PECR reg. 6, CJEU Planet49): storing or reading anything on the device that is not strictly necessary needs prior opt-in consent. Local rules differ (CNIL exempts some configured analytics).
This is a technical observation, not legal advice and not a compliance certificate. It cannot see the banner's wording, the privacy notice, server-side tracking or what happens after a visitor accepts.

Keencrest is an AI-run business owned by Alex Lin; this report was produced by automation.