Waivern Consent Analyser ← Home Log

ePrivacy / GDPR Compliance Report · ePrivacy/GDPR (EU)

Consent Compliance Report

2026-03-31 19:42:21 UTC · https://www.theguardian.com · CMP: Sourcepoint 🤖 AI on

📍 Analysis ran from: 🇳🇱 Amsterdam, North Holland, The Netherlands · IP: 208.77.244.106 · Railway · Results reflect how this site presents to this location.

Post Reject All — compliance state

4 FAIL 31 PASS 4 MANUAL · 3 warn 0 err

CMP Interaction

Banner detected	True
Accept button	Accept all
Reject button	Reject all and subscribe
Clicks to accept / reject	1 / 1
Reject buried in manage panel	False

Screenshots

Pre-Consent — initial page load

Post Accept All — consent baseline

Post Reject All — compliance state

Section M — Summary

Category	Result
Pre Consent Clean	✓ PASS
No Tracking Cookies Pre Consent	✓ PASS
Tracker Globals Undefined	✓ PASS
No Tracking Storage Pre Consent	✓ PASS
Network Blocked After Decline	✓ PASS
Third Party Cookies Absent	⚠ PARTIAL
Doc Cookie Clean Post Reject	✓ PASS
Web Storage Clean Post Reject	✓ PASS
First Party Cookies Classified	ℹ INFO
Server Side Cookies Gated	✗ FAIL
No Cname Cloaking	✓ PASS
Tracker Globals Absent	✗ FAIL
Dom Scripts Blocked	✓ PASS
Reject Equals Accept Clicks	✓ PASS
No Preticked Boxes	☐ MANUAL
Persistent Withdrawal Widget	✓ PASS
No Cookie Wall	✓ PASS
Consent Persists	✓ PASS

Run Log 77 entries · ⚠ 3 warning(s) · raw JSON

elapsed	level	session	message
0.0s	▶ STEP	MAIN	Run 14331fe1 started {"url": "https://www.theguardian.com"}
0.0s	· INFO	MAIN	Detecting probe server location
0.2s	· INFO	MAIN	Probe location {"ip": "208.77.244.106", "city": "Amsterdam", "region": "North Holland", "country": "The Netherlands", "country_code": "NL", "org": "Railway", "latitude": 52.37403, "longitude": 4.88969}
0.2s	▶ STEP	MAIN	Starting analysis of https://www.theguardian.com {"mode": "GDPR"}
0.9s	· INFO	MAIN	Chromium launched {"headless": true}
0.9s	· INFO	PREFLIGHT	Navigating to https://www.theguardian.com
3.3s	· INFO	PREFLIGHT	Network idle reached
3.4s	▶ STEP	A	Session A start (accept path)
3.5s	· INFO	A	Navigating to https://www.theguardian.com
5.6s	· INFO	A	Network idle reached
7.6s	· INFO	A	Capturing pre-consent state
7.9s	· INFO	A	Pre-consent state captured {"pre_consent_cookies": 7, "pre_consent_ad_cookies": 0, "pre_consent_tracking_storage": 0, "pre_consent_tracker_globals": [], "pre_consent_unblocked_scripts": 0, "pre_consent_capture_error": null}
8.8s	· INFO	A	Banner: found
9.3s	· INFO	A	Accept All interaction {"cmp": "Sourcepoint", "button_text": "Accept all", "clicked": true, "in_iframe": true, "error": null}
11.3s	· INFO	A	Capturing post-accept baseline state
13.1s	· INFO	A	Baseline captured {"baseline_cookies": 34, "baseline_ad_cookies": 1, "baseline_tracking_storage": 1, "baseline_tracker_globals": [], "baseline_unblocked_scripts": 13, "baseline_capture_error": null}
14.3s	· INFO	A	Context closed, HAR saved
14.3s	▶ STEP	A	Session A complete {"pre_consent_cookies": 7, "pre_consent_ad_cookies": 0, "pre_consent_tracking_storage": 0, "pre_consent_tracker_globals": [], "pre_consent_unblocked_scripts": 0, "pre_consent_capture_error": null, "baseline_cookies": 34, "baseline_ad_cookies": 1, "baseline_tracking_storage": 1, "baseline_tracker_globals": [], "baseline_unblocked_scripts": 13, "baseline_capture_error": null}
14.3s	▶ STEP	B	Session B start (reject path)
14.3s	· INFO	B	Navigating to https://www.theguardian.com
16.6s	· INFO	B	Network idle reached
18.6s	· INFO	B	Capturing pre-consent state
18.6s	· INFO	B	Pre-consent B captured {"pre_consent_B_cookies": 7, "pre_consent_B_ad_cookies": 0, "pre_consent_B_tracking_storage": 0, "pre_consent_B_tracker_globals": [], "pre_consent_B_unblocked_scripts": 0, "pre_consent_B_capture_error": null}
19.6s	· INFO	B	Banner: found
19.6s	· INFO	B	Persistent widget found pre-reject (CMP fully loaded) {"found": true, "text": "(consent widget)", "in_iframe": false}
24.8s	· INFO	B	Click symmetry measured {"accept_clicks": 1, "reject_clicks": 1}
27.8s	· INFO	B	Reject All interaction {"cmp": "Sourcepoint", "button_text": "Reject all and subscribe", "clicked": true, "clicks_required": 1, "required_manage_panel": false, "panel_navigated": false, "panel_new_frames": 0, "panel_wait_s": 0.0, "error": null}
29.9s	· INFO	B	Site accessible after reject: True
29.9s	· INFO	B	Capturing post-reject state
30.1s	· INFO	B	Post-reject captured {"post_reject_cookies": 10, "post_reject_ad_cookies": 0, "post_reject_tracking_storage": 0, "post_reject_tracker_globals": ["google_tag_manager"], "post_reject_unblocked_scripts": 0, "post_reject_capture_error": null}
30.1s	· INFO	B	Persistent widget check {"found": true, "text": "(consent widget)", "in_iframe": false}
30.1s	· INFO	B	Capturing subpages
36.7s	· INFO	B	2 subpage(s) captured {"urls": ["https://www.theguardian.com/europe", "https://www.theguardian.com/europe"], "errors": []}
37.5s	· INFO	B	Context closed, HAR saved
37.5s	· INFO	B	Checking pre-ticked toggles (separate session)
37.6s	· INFO	B	Navigating to https://www.theguardian.com
39.6s	· INFO	B	Network idle reached
66.2s	⚠ WARN	B	Manage/preferences button not visible after 5s wait — toggle check may return 0 results
68.3s	· INFO	B	Pre-ticked toggles: 0 found {"toggles": {}}
68.3s	⚠ WARN	B	Toggle check returned 0 results — diagnostics: {"manage_button_found": false, "manage_button_text": null, "frames_scanned": [], "total_elements_found": 0, "note": "Manage/preferences button not found on page"}
68.3s	▶ STEP	B	Session B complete {"post_reject_cookies": 10, "post_reject_ad_cookies": 0, "post_reject_tracking_storage": 0, "post_reject_tracker_globals": ["google_tag_manager"], "post_reject_unblocked_scripts": 0, "post_reject_capture_error": null, "accept_clicks": 1, "reject_clicks": 1, "reject_at_first_screen": true, "subpages_captured": 2}
68.3s	▶ STEP	C	Session C start (persistence check)
68.3s	· INFO	C	Navigating to https://www.theguardian.com
70.5s	· INFO	C	Network idle reached
76.4s	· INFO	C	Reject for persistence test {"clicked": true, "error": null}
78.4s	· INFO	C	Opening second tab (same-session test)
78.5s	· INFO	C	Navigating to https://www.theguardian.com
80.3s	· INFO	C	Network idle reached
82.4s	· INFO	C	Same-session state captured {"persistence_1_cookies": 10, "persistence_1_ad_cookies": 0, "persistence_1_tracking_storage": 0, "persistence_1_tracker_globals": [], "persistence_1_unblocked_scripts": 0, "persistence_1_capture_error": null}
82.5s	· INFO	C	Storage state saved, opening new context
82.7s	· INFO	C	Navigating to https://www.theguardian.com
85.2s	· INFO	C	Network idle reached
87.3s	· INFO	C	New-session state captured {"persistence_2_cookies": 10, "persistence_2_ad_cookies": 0, "persistence_2_tracking_storage": 0, "persistence_2_tracker_globals": [], "persistence_2_unblocked_scripts": 0, "persistence_2_capture_error": null}
87.3s	▶ STEP	C	Session C complete {"persistence_1_captured": true, "persistence_2_captured": true}
87.3s	▶ STEP	POLICY_RENDER	Rendering cookie policy page in browser
87.7s	· INFO	POLICY_RENDER	Navigating to policy: https://www.theguardian.com/privacy
95.6s	· INFO	POLICY_RENDER	Extracted 44174 chars from policy page
95.6s	· INFO	POLICY_RENDER	Policy page rendered (44174 chars)
95.7s	· INFO	MAIN	Browser closed
95.7s	▶ STEP	DNS	Running CNAME cloaking checks
95.7s	· INFO	DNS	Apex domain: theguardian.com (from hostname: www.theguardian.com)
95.9s	· INFO	DNS	Checking 4 subdomain(s) {"subdomains": ["ophan.theguardian.com", "sourcepoint.theguardian.com", "support.theguardian.com", "static.theguardian.com"]}
95.9s	· INFO	DNS	CNAME check done — 0 tracker CNAME(s) {"results": [{"sub": "ophan.theguardian.com", "cname": null, "tracker": false, "vendor": null}, {"sub": "sourcepoint.theguardian.com", "cname": null, "tracker": false, "vendor": null}, {"sub": "support.theguardian.com", "cname": null, "tracker": false, "vendor": null}, {"sub": "static.theguardian.com", "cname": null, "tracker": false, "vendor": null}]}
95.9s	▶ STEP	POLICY	Fetching cookie policy
95.9s	· INFO	POLICY	Policy found at https://www.theguardian.com/privacy
95.9s	· INFO	POLICY	Fetching policy, cross-referencing 34 cookie(s)
107.3s	· INFO	POLICY	Policy fetch OK {"declared": 54, "undeclared_observed": 31, "ai_used": true}
107.3s	⚠ WARN	POLICY	31 cookie(s) not in policy {"cookies": ["panoramaIdType", "receive-cookie-deprecation", "GU_geo_country", "_cc_dc", "khaos", "gu_client_ab_tests", "bwid_withoutSameSiteForIncompatibleClients", "cto_bundle", "UID", "i", "pxid", "GU_mvt_id", "_cc_id", "uid", "panoramaId_expiry", "permutive-id", "_scor_uid", "_pubcid_cst", "test_cookie", "lotame_domain_check"]}
107.3s	▶ STEP	MAIN	Analysis complete {"error_count": 0}
107.3s	▶ STEP	C1	Running Component 1 HAR analysis
107.5s	· INFO	C1	Phase hint timestamps passed to HAR analyser {"reject_click": "2026-03-31T19:41:01"}
107.6s	· INFO	C1	HAR analysis complete — 1 FAIL item(s) {"total_requests": 379, "phases": ["pre_consent", "post_reject"], "phase_strategy": {"accept": "not_detected", "reject": "timestamp_hint"}, "fail_items": ["G.7"]}
107.8s	· INFO	C1	Extracted 1 TCF string(s) from accept-path HAR {"purposes_found": ["All 10 core purposes CONSENTED"]}
107.8s	· INFO	C1	Running C1 on accept-path HAR for C.2/C.3 baseline
107.8s	· INFO	C1	Accept-HAR promoted 2 item(s): ['C.2', 'C.3'] {"phases": ["pre_consent", "post_accept"]}
107.8s	▶ STEP	CHECKS	Running browser-state checks
107.8s	· INFO	CHECKS	Browser checks complete — 2 FAIL item(s) {"fail_items": ["G.2", "H.1"], "mode": "gdpr"}

Detailed Findings

B. Pre-Consent State 5 PASS 0 MANUAL

B.1 No tracking requests before consent banner interaction

✓ PASS

No consent-required domains observed before the consent signal.

B.2 No analytics/marketing cookies in Storage pre-consent

✓ PASS

No advertising cookies found in Storage before consent.

B.3 JS tracker globals return undefined pre-consent

✓ PASS

All probed tracker globals are undefined pre-consent.

B.4 No tracking identifiers in localStorage/sessionStorage pre-consent

✓ PASS

No tracking keys found in web storage pre-consent.

B.5 Non-essential scripts have type=text/plain (CMP-blocked) in DOM

✓ PASS

All tracking scripts in DOM appear to be CMP-blocked (type=text/plain) or absent.

C. Baseline Capture 0 PASS 0 MANUAL

C.2 Inventory of third-party tracking domains active after Accept All

ℹ INFO

41 tracking domains active after consent-all (baseline).

▶ Show all 41 rows

domain	vendor	category	first_seen	example_url
pixel.adsafeprotected.com	IAS Pixel	MEASUREMENT	2026-03-31T19:40:44	https://pixel.adsafeprotected.com/services/pub?anId=10249&slot=%7Bid:dfp-ad--top-above-nav,ss:%5B1.1,2.2,728.90,940.230,
cm.g.doubleclick.net	Google DoubleClick	ADVERTISING	2026-03-31T19:40:44	https://cm.g.doubleclick.net/partnerpixels?gdpr_consent=CQh7pEAQh7pEABwABCENCYFgAP_gAEPgABpYKoNB5C4USCFAKCJ1YJsgIAQXwRAA
ads.pubmatic.com	PubMatic	ADVERTISING	2026-03-31T19:40:44	https://ads.pubmatic.com/AdServer/js/google-esp.js
tags.crwdcntrl.net	Lotame	IDENTITY	2026-03-31T19:40:44	https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
cdn.id5-sync.com	ID5 (universal ID)	IDENTITY	2026-03-31T19:40:44	https://cdn.id5-sync.com/api/1.0/esp.js
id5-sync.com	ID5 (universal ID)	IDENTITY	2026-03-31T19:40:44	https://id5-sync.com/api/esp/increment?counter=no-config
api.id5-sync.com	ID5	IDENTITY	2026-03-31T19:40:44	https://api.id5-sync.com/analytics/182/id5-api-js
oajs.openx.net	OpenX	ADVERTISING	2026-03-31T19:40:44	https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.theguardian.com%2Feurope&rid=esp
bcp.crwdcntrl.net	Lotame	IDENTITY	2026-03-31T19:40:44	https://bcp.crwdcntrl.net/6/map?xcid=16589
ib.adnxs.com	Xandr AppNexus	ADVERTISING	2026-03-31T19:40:44	https://ib.adnxs.com/getuidj?gdpr=1&gdpr_consent=CQh7pEAQh7pEABwABCENCYFgAP_gAEPgABpYKoNB5C4USCFAKCJ1YJsgIAQXwRAA4gQABgA
fastlane.rubiconproject.com	Magnite	ADVERTISING	2026-03-31T19:40:45	https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=26644&site_id=549496&zone_id=3426828&size_id=2&alt_si
rtb.openx.net	OpenX	ADVERTISING	2026-03-31T19:40:45	https://rtb.openx.net/openrtbb/prebidjs
elb.the-ozone-project.com	Ozone Project	IDENTITY	2026-03-31T19:40:45	https://elb.the-ozone-project.com/openrtb2/auction
htlb.casalemedia.com	Index Exchange	ADVERTISING	2026-03-31T19:40:45	https://htlb.casalemedia.com/openrtb/pbjs?s=208283
pagead2.googlesyndication.com	Google AdSense/GAM	ADVERTISING	2026-03-31T19:40:45	https://pagead2.googlesyndication.com/pagead/ping?e=1
google-bidout-d.openx.net	OpenX	ADVERTISING	2026-03-31T19:40:45	https://google-bidout-d.openx.net/w/1.0/pd?plm=5
image6.pubmatic.com	PubMatic	ADVERTISING	2026-03-31T19:40:45	https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=5&p=156578&publisherId=156578&src=esp_google&ver=1&coppa=0&gdpr_c
pubads.g.doubleclick.net	Google DoubleClick	ADVERTISING	2026-03-31T19:40:45	https://pubads.g.doubleclick.net/activity;dc_iu=/59666047/DFPAudiencePixel;ord=1;dc_seg=895181798;permutive=23527?
hbopenbid.pubmatic.com	PubMatic OpenBid	ADVERTISING	2026-03-31T19:40:45	https://hbopenbid.pubmatic.com/translator?source=prebid-client&gzip=1
pixel.rubiconproject.com	Magnite (Rubicon)	ADVERTISING	2026-03-31T19:40:45	https://pixel.rubiconproject.com/exchange/sync.php?p=a9eu&gdpr_consent=CQh7pEAQh7pEABwABCENCYFgAP_gAEPgABpYKoNB5C4USCFAK
ssum-sec.casalemedia.com	Index Exchange	ADVERTISING	2026-03-31T19:40:45	https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fecm3%3Fex%3Dindex.
ssbsync.smartadserver.com	Smart (Equativ)	ADVERTISING	2026-03-31T19:40:45	https://ssbsync.smartadserver.com/api/sync?callerId=2&gdpr_consent=CQh7pEAQh7pEABwABCENCYFgAP_gAEPgABpYKoNB5C4USCFAKCJ1Y
dsum-sec.casalemedia.com	Index Exchange	ADVERTISING	2026-03-31T19:40:45	https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dca
secure.adnxs.com	Xandr (AppNexus)	ADVERTISING	2026-03-31T19:40:45	https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID
us-u.openx.net	OpenX	ADVERTISING	2026-03-31T19:40:45	https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=1&gdpr_consent=CQh7pEAQh7pE
sync.ipredictive.com	iPromote	ADVERTISING	2026-03-31T19:40:45	https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=1&gd
ep1.adtrafficquality.google	Google SODAR/IVT	ADVERTISING	2026-03-31T19:40:45	https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gpt&tv=m202603250101&st=env&sjk=6411510798165893
securepubads.g.doubleclick.net	Google Publisher Ads	ADVERTISING	2026-03-31T19:40:45	https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6411510798165893&correlator=3748217310167902&eid=31097431%2C3109
df2f4d698ae010735b53fbcbb2e00cc1.safeframe.googlesyndication.com	Google SafeFrame (viewability)	MEASUREMENT	2026-03-31T19:40:45	https://df2f4d698ae010735b53fbcbb2e00cc1.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
sync.crwdcntrl.net	Lotame	IDENTITY	2026-03-31T19:40:45	https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=5f51420a-6b1b-4c94-993a-12f84b808716-69cc233d-4e4c&gdpr=1&gdpr_conse
cms.quantserve.com	Quantcast Measure	ANALYTICS	2026-03-31T19:40:45	https://cms.quantserve.com/pixel/p-zLwwakwy-hZw3.gif?idmatch=0&ssp=gumgum2&gdpr=1&gdpr_consent=CQh7pEAQh7pEABwABCENCYFgA
c1.adform.net	Adform	ADVERTISING	2026-03-31T19:40:45	https://c1.adform.net/serving/cookie/match?party=1301&gdpr=1&gdpr_consent=CQh7pEAQh7pEABwABCENCYFgAP_gAEPgABpYKoNB5C4USC
ep2.adtrafficquality.google	Google SODAR/IVT	ADVERTISING	2026-03-31T19:40:46	https://ep2.adtrafficquality.google/sodar/sodar2.js
secure-assets.rubiconproject.com	Magnite (Rubicon)	ADVERTISING	2026-03-31T19:40:46	https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
eus.rubiconproject.com	Magnite (Rubicon)	ADVERTISING	2026-03-31T19:40:46	https://eus.rubiconproject.com/usync.html?p=gumgum
simage2.pubmatic.com	PubMatic	ADVERTISING	2026-03-31T19:40:46	https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=1&gdpr_consent=CQh7pEAQh7p
image2.pubmatic.com	PubMatic	ADVERTISING	2026-03-31T19:40:46	https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=1&gdpr_consent=CQh7pEAQh7pE
eu-u.openx.net	OpenX	ADVERTISING	2026-03-31T19:40:46	https://eu-u.openx.net/w/1.0/sd?id=537113484&val=1514120448363740908
track.adform.net	Adform Tracking	ADVERTISING	2026-03-31T19:40:46	https://track.adform.net/serving/cookie/match/?party=1008&gdpr=1&gdpr_consent=CQh7pEAQh7pEABwABCENCYFgAP_gAEPgABpYKoNB5C
token.rubiconproject.com	Magnite (Rubicon)	ADVERTISING	2026-03-31T19:40:46	https://token.rubiconproject.com/khaos.json?gdpr_consent=CQh7pEAQh7pEABwABCENCYFgAP_gAEPgABpYKoNB5C4USCFAKCJ1YJsgIAQXwRA
tpc.googlesyndication.com	Google AdSense	ADVERTISING	2026-03-31T19:40:46	https://tpc.googlesyndication.com/safeframe/1-0-45/js/ext.js

C.3 Full cookie inventory (with expiry, HttpOnly, Secure, SameSite) after Accept All

ℹ INFO

34 cookies in storage after Accept All (full metadata).

▶ Show all 34 rows

name	domain	expires_days	http_only	secure	same_site	classification
GU_mvt_id	.theguardian.com	90.0	False	True	Lax	UNKNOWN
gu_client_ab_tests	www.theguardian.com	30.0	False	False	Lax	UNKNOWN
gu_v2_mvt_id	www.theguardian.com	30.0	False	False	Lax	UNKNOWN
GU_geo_country	www.theguardian.com	session	False	True	Lax	UNKNOWN
bwid	.theguardian.com	365.0	False	True	None	UNKNOWN
bwid_withoutSameSiteForIncompatibleClients	.theguardian.com	365.0	True	True	Lax	UNKNOWN
consentUUID	.theguardian.com	365.0	False	True	None	ESSENTIAL
consentDate	.theguardian.com	365.0	False	True	None	ESSENTIAL
_pubcid	.theguardian.com	270.0	False	False	Lax	UNKNOWN
_pubcid_cst	.theguardian.com	365.0	False	False	Lax	UNKNOWN
id5	.id5-sync.com	90.0	False	True	None	UNKNOWN
test_cookie	.doubleclick.net	0.0	False	True	None	UNKNOWN
_scor_uid	.theguardian.com	390.0	False	True	None	UNKNOWN
UID	.scorecardresearch.com	390.0	False	True	None	UNKNOWN
XID	.scorecardresearch.com	390.0	False	True	None	UNKNOWN
permutive-id	.theguardian.com	184.0	False	True	None	UNKNOWN
uid	.criteo.com	390.0	False	True	None	UNKNOWN
lotame_domain_check	.theguardian.com	0.0	False	False	Lax	UNKNOWN
A3	.yahoo.com	365.2	True	True	None	UNKNOWN
connectId	.theguardian.com	365.0	False	True	None	UNKNOWN
i	.openx.net	365.0	False	True	None	UNKNOWN
cto_bundle	.criteo.com	390.0	False	True	None	UNKNOWN
_cc_dc	.crwdcntrl.net	270.0	False	True	None	UNKNOWN
_cc_id	.crwdcntrl.net	270.0	False	True	None	UNKNOWN
pxid	.d6691a17-6fdb-4d26-85d6-b3dd27f55f08.prmutv.co	91.0	True	True	None	UNKNOWN
_cc_id	.theguardian.com	270.0	False	False	Lax	UNKNOWN
panoramaId_expiry	.theguardian.com	7.0	False	False	Lax	UNKNOWN
panoramaId	.theguardian.com	7.0	False	False	Lax	UNKNOWN
panoramaIdType	.theguardian.com	7.0	False	False	Lax	UNKNOWN
khaos	.rubiconproject.com	365.0	False	True	None	UNKNOWN
audit	.rubiconproject.com	365.0	False	True	None	UNKNOWN
cto_bundle	.theguardian.com	390.0	False	False	Lax	UNKNOWN
ad-id	.amazon-adsystem.com	184.0	True	True	None	UNKNOWN
receive-cookie-deprecation	.casalemedia.com	365.0	True	True	None	AD

C.4 Tracker JS globals active after Accept All (baseline)

ℹ INFO

Globals defined after consent: []

D. Decline Non-Essential Consent 1 PASS 0 MANUAL

D.4 Reject requires no more clicks than Accept (EDPB symmetry)

✓ PASS

Accept and Reject both require 1 click(s). Symmetric.

accept clicks: 1 · reject clicks: 1 · extra clicks to reject: 0 · reject required manage panel: False

E. Network Request Verification 4 PASS 0 MANUAL

E.1 No requests to non-essential third-party domains after reject-all

✓ PASS

No tracking domains observed post-reject.

E.2 No tracker JS libraries loaded after reject-all

✓ PASS

No tracker scripts observed post-reject.

E.3 No tracking pixels or beacons fired after reject-all

✓ PASS

No tracking beacons observed post-reject.

E.4 No tracking activity on subpages after reject-all

✓ PASS

No tracker globals or tracking storage observed on 2 subpage(s).

F. Cookie Verification (Third-Party) 1 FAIL 2 PASS 0 MANUAL

F.1 No analytics/marketing cookies present after reject-all

⚠ PARTIAL

No advertising cookies seen in request headers post-reject. Verify Storage tab with Component 2 for full confirmation.

F.2 document.cookie contains only essential cookies post-reject

✓ PASS

No advertising cookies visible in document.cookie post-reject.

doc cookie snippet: GU_mvt_id=173575; bwid=idFromPV_RRRliJR17YwySLr-gCLFaA; consentUUID=5fef39e5-de08-4cf3-8c8e-654f8e422ba0; GU_geo_country=NL; GU_country=NL

F.3 No tracking identifiers in web storage post-reject

✓ PASS

No tracking identifiers found in localStorage/sessionStorage post-reject.

G. First-Party Cookie Classification 2 FAIL 6 PASS 0 MANUAL

G.1 Complete first-party cookie inventory with full metadata

ℹ INFO

19 first-party cookies in Storage after Accept All.

▶ Show all 19 rows

name	domain	expires_days	http_only	secure	same_site	classification
GU_mvt_id	.theguardian.com	90.0	False	True	Lax	UNKNOWN
gu_client_ab_tests	www.theguardian.com	30.0	False	False	Lax	UNKNOWN
gu_v2_mvt_id	www.theguardian.com	30.0	False	False	Lax	UNKNOWN
GU_geo_country	www.theguardian.com	session	False	True	Lax	UNKNOWN
bwid	.theguardian.com	365.0	False	True	None	UNKNOWN
bwid_withoutSameSiteForIncompatibleClients	.theguardian.com	365.0	True	True	Lax	UNKNOWN
consentUUID	.theguardian.com	365.0	False	True	None	ESSENTIAL
consentDate	.theguardian.com	365.0	False	True	None	ESSENTIAL
_pubcid	.theguardian.com	270.0	False	False	Lax	UNKNOWN
_pubcid_cst	.theguardian.com	365.0	False	False	Lax	UNKNOWN
_scor_uid	.theguardian.com	390.0	False	True	None	UNKNOWN
permutive-id	.theguardian.com	184.0	False	True	None	UNKNOWN
lotame_domain_check	.theguardian.com	0.0	False	False	Lax	UNKNOWN
connectId	.theguardian.com	365.0	False	True	None	UNKNOWN
_cc_id	.theguardian.com	270.0	False	False	Lax	UNKNOWN
panoramaId_expiry	.theguardian.com	7.0	False	False	Lax	UNKNOWN
panoramaId	.theguardian.com	7.0	False	False	Lax	UNKNOWN
panoramaIdType	.theguardian.com	7.0	False	False	Lax	UNKNOWN
cto_bundle	.theguardian.com	390.0	False	False	Lax	UNKNOWN

G.2 All observed cookies declared in cookie policy

✗ FAIL

31 cookie(s) observed but not found in cookie policy at https://www.theguardian.com/privacy.

▶ Show all 30 rows

cookie_name	status
panoramaIdType	observed but not in cookie policy
receive-cookie-deprecation	observed but not in cookie policy
GU_geo_country	observed but not in cookie policy
_cc_dc	observed but not in cookie policy
khaos	observed but not in cookie policy
gu_client_ab_tests	observed but not in cookie policy
bwid_withoutSameSiteForIncompatibleClients	observed but not in cookie policy
cto_bundle	observed but not in cookie policy
UID	observed but not in cookie policy
i	observed but not in cookie policy
pxid	observed but not in cookie policy
GU_mvt_id	observed but not in cookie policy
_cc_id	observed but not in cookie policy
uid	observed but not in cookie policy
panoramaId_expiry	observed but not in cookie policy
permutive-id	observed but not in cookie policy
_scor_uid	observed but not in cookie policy
_pubcid_cst	observed but not in cookie policy
test_cookie	observed but not in cookie policy
lotame_domain_check	observed but not in cookie policy
XID	observed but not in cookie policy
bwid	observed but not in cookie policy
ad-id	observed but not in cookie policy
_pubcid	observed but not in cookie policy
GU_country	observed but not in cookie policy
gu_v2_mvt_id	observed but not in cookie policy
A3	observed but not in cookie policy
GU_support_csrf	observed but not in cookie policy
connectId	observed but not in cookie policy
audit	observed but not in cookie policy

G.3 Strictly necessary two-part test (AI-assisted)

✓ PASS

AI analysis: 0 cookie(s) fail the strictly-necessary test and should be absent after reject-all. Summary:

G.4 Server-side analytics/ad cookies identified in Set-Cookie headers

✓ PASS

No advertising cookies observed in Set-Cookie response headers.

G.5 No CNAME cloaking detected (first-party subdomains resolving to tracker infrastructure)

✓ PASS

No CNAME cloaking detected across 4 subdomain(s).

subdomain	cname_target	is_tracker	vendor	error
ophan.theguardian.com	(no CNAME / A record only)	False	None	None
sourcepoint.theguardian.com	(no CNAME / A record only)	False	None	None
support.theguardian.com	(no CNAME / A record only)	False	None	None
static.theguardian.com	(no CNAME / A record only)	False	None	None

G.6 Non-essential first-party cookies absent after reject-all

✓ PASS

All advertising cookies absent from Storage post-reject.

G.7 No non-essential Set-Cookie headers after reject-all

✗ FAIL

8 Set-Cookie header(s) for non-essential cookies observed post-reject.

cookie_name	domain	header	classification	timestamp
GU_mvt_id	www.theguardian.com	GU_mvt_id=173575; expires=Mon, 29 Jun 2026 19:41:03 GMT; path=/; domain=.theguardian.com; Secure	UNKNOWN	2026-03-31T19:41:03
gu_client_ab_tests	www.theguardian.com	gu_client_ab_tests=growth-auxia-banner:control; path=/; max-age=2592000	UNKNOWN	2026-03-31T19:41:03
gu_v2_mvt_id	www.theguardian.com	gu_v2_mvt_id=348; path=/; max-age=2592000	UNKNOWN	2026-03-31T19:41:03
GU_geo_country	www.theguardian.com	GU_geo_country=NL; path=/; Secure	UNKNOWN	2026-03-31T19:41:03
bwid	ophan.theguardian.com	bwid=idFromPV_RRRliJR17YwySLr-gCLFaA; Max-Age=31536000; Expires=Wed, 31 Mar 2027 19:41:04 GMT; SameSite=None; Path=/; Domain=.theguardian.com; Secure	UNKNOWN	2026-03-31T19:41:04
bwid_withoutSameSiteForIncompatibleClients	ophan.theguardian.com	bwid_withoutSameSiteForIncompatibleClients=idFromPV_RRRliJR17YwySLr-gCLFaA; Max-Age=31536000; Expires=Wed, 31 Mar 2027 19:41:04 GMT; Path=/; Domain=.t	UNKNOWN	2026-03-31T19:41:04
bwid	ophan.theguardian.com	bwid=idFromPV_RRRliJR17YwySLr-gCLFaA; Max-Age=31536000; Expires=Wed, 31 Mar 2027 19:41:07 GMT; SameSite=None; Path=/; Domain=.theguardian.com; Secure	UNKNOWN	2026-03-31T19:41:07
bwid_withoutSameSiteForIncompatibleClients	ophan.theguardian.com	bwid_withoutSameSiteForIncompatibleClients=idFromPV_RRRliJR17YwySLr-gCLFaA; Max-Age=31536000; Expires=Wed, 31 Mar 2027 19:41:07 GMT; Path=/; Domain=.t	UNKNOWN	2026-03-31T19:41:07

Recommendation: Backend services must be aware of consent state. Identity tokens and advertising identifiers must not be set or refreshed via server-side Set-Cookie after a reject-all signal has been recorded.

G.8 Cookie lifetime analysis (ITP bypass detection)

✓ PASS

No obvious ITP bypass patterns in Set-Cookie headers.

G.9 No tracking keys in first-party localStorage/sessionStorage post-reject

✓ PASS

No tracking identifiers found in first-party web storage post-reject.

H. JS Global Object Verification 1 FAIL 1 PASS 0 MANUAL

H.1 Tracker JS globals (ga, gtag, fbq, hj, etc.) return undefined post-reject

✗ FAIL

Tracker globals still defined after reject-all: ['google_tag_manager']

global: google_tag_manager · type: __defined_object__

H.2 Tracker globals not merely defined without values

ℹ INFO

See H.1 — same evidence applies.

global: google_tag_manager · present: True

H.3 window.dataLayer absent or contains no tracking events post-reject

✓ PASS

dataLayer not present post-reject.

I. DOM / Source Inspection 3 PASS 0 MANUAL

I.1 Tracker script tags have type=text/plain (CMP-blocked) in DOM post-reject

✓ PASS

All 0 tracker scripts correctly blocked in DOM post-reject.

I.2 Non-essential scripts blocked (type=text/plain)

✓ PASS

See I.1 — same check.

I.3 No tracker JS files in executed sources post-reject

✓ PASS

Based on DOM script inventory; full Sources tab verification requires Chrome DevTools protocol introspection (beyond current scope).

J. Safari-Specific Considerations 1 PASS 2 MANUAL

J.1 ITP setting

☐ MANUAL

Requires manual browser configuration check.

J.2 ITP-off re-test

☐ MANUAL

Requires manual browser configuration check.

J.3 Server-side cookie-setting identified where ITP would block client-side

✓ PASS

No obvious ITP-bypass server-side cookies detected.

K. Consent Mechanism UX Compliance 3 PASS 2 MANUAL

K.1 Reject All at same prominence and level as Accept All

✓ PASS

Reject All available at first screen at same level as Accept All.

accept visible at first screen: True · reject visible at first screen: True · reject requires extra layer: False · accept button text: Accept all · reject button text: Reject all and subscribe

K.2 Non-essential categories default to OFF

☐ MANUAL

Could not open preferences panel to check toggles.

K.3 No dark patterns in consent banner (colour, visual hierarchy)

☐ MANUAL

DOM-level button detection completed. Full visual assessment of colour contrast, typography prominence, and deceptive visual hierarchy requires screenshot review. See screenshots in report.

K.5 Persistent consent withdrawal mechanism accessible after interaction

✓ PASS

Persistent consent widget found: '(consent widget)'

found: True · text: (consent widget) · in iframe: False

K.6 Site fully accessible after declining consent (no cookie wall)

✓ PASS

Site content accessible after declining consent.

accessible: True

L. Consent State Persistence 2 PASS 0 MANUAL

L.2 Consent choice respected on second tab (same session)

✓ PASS

Consent preference correctly persisted to second tab.

consent cookie found: True · ad cookies found: False · tcf available: True · tcf display status: None

L.3 Declined state maintained after closing and reopening (simulate new session)

✓ PASS

No advertising cookies found on simulated return visit.

ad cookies on return: False · total cookies: 10

Additional Findings 3 PASS 0 MANUAL

ADD.1 Persistent identifier bridging across consent states

✓ PASS

No persistent cross-phase identifiers detected in POST bodies.

ADD.2 TCF consent string analysis (all phases)

ℹ INFO

No TCF consent strings detected in query parameters.

phase	post_accept
domain	cm.g.doubleclick.net
timestamp	2026-03-31T19:40:44
summary	Accept-all (purposes 1–10 consented, CMP: Unknown CMP (ID 112))
is reject all	False
is accept all	True
cmp	Unknown CMP (ID 112)
tcf policy version	5
purpose consents	All 10 core purposes CONSENTED
li claims	27891011
decode error	None

ADD.3 Session ID bridging across consent and rejection phases

✓ PASS

No session ID bridging detected across consent states.

ADD.4 Persistent vendor userIds transmitted after reject-all

✓ PASS

No persistent vendor userIds detected in post-reject requests.

Test Details 0 PASS 0 MANUAL

META Site URL, test date, CMP platform

ℹ INFO

CMP identified as: Sourcepoint CMP

url	Latest news, sport and opinion from the Guardian
test date	2026-03-31
test time utc	2026-03-31T19:40:48
cmp detected	Sourcepoint CMP
total requests	379
phases detected	pre_consentpost_reject
phase strategy	{'accept': 'not_detected', 'reject': 'timestamp_hint'}

run_id: 14331fe1 · raw log · ⬇ report JSON · all runs · ← Home

🤖 AI-Enhanced Analysis

Add regulatory citations, risk ratings, enforcement precedents, and a remediation roadmap using Claude AI. Results are cached — generation only runs once per report.

🤖 View AI Report