Waivern Consent Analyser ← Home Log

ePrivacy / GDPR Compliance Report · ePrivacy/GDPR (EU)

Consent Compliance Report

2026-04-01 23:30:52 UTC · https://www.bbc.co.uk · CMP: Sourcepoint 🤖 AI on

📍 Analysis ran from: 🇳🇱 Amsterdam, North Holland, The Netherlands · IP: 208.77.244.106 · Railway · Results reflect how this site presents to this location.

Post Reject All — compliance state

17 FAIL 19 PASS 4 MANUAL · 3 warn 0 err

CMP Interaction

Banner detected	True
Accept button	I agree
Reject button	I do not agree
Clicks to accept / reject	1 / 1
Reject buried in manage panel	False

Screenshots

Pre-Consent — initial page load

Post Accept All — consent baseline

Post Reject All — compliance state

Section M — Summary

Category	Result
Pre Consent Clean	✗ FAIL
No Tracking Cookies Pre Consent	✗ FAIL
Tracker Globals Undefined	✗ FAIL
No Tracking Storage Pre Consent	✓ PASS
Network Blocked After Decline	✗ FAIL
Third Party Cookies Absent	✗ FAIL
Doc Cookie Clean Post Reject	✗ FAIL
Web Storage Clean Post Reject	✓ PASS
First Party Cookies Classified	ℹ INFO
Server Side Cookies Gated	✗ FAIL
No Cname Cloaking	✓ PASS
Tracker Globals Absent	✗ FAIL
Dom Scripts Blocked	✗ FAIL
Reject Equals Accept Clicks	✓ PASS
No Preticked Boxes	☐ MANUAL
Persistent Withdrawal Widget	✓ PASS
No Cookie Wall	✓ PASS
Consent Persists	✗ FAIL

Run Log 77 entries · ⚠ 3 warning(s) · raw JSON

elapsed	level	session	message
0.0s	▶ STEP	MAIN	Run f3331e88 started {"url": "https://www.bbc.co.uk"}
0.0s	· INFO	MAIN	Detecting probe server location
0.2s	· INFO	MAIN	Probe location {"ip": "208.77.244.106", "city": "Amsterdam", "region": "North Holland", "country": "The Netherlands", "country_code": "NL", "org": "Railway", "latitude": 52.37403, "longitude": 4.88969}
0.2s	▶ STEP	MAIN	Starting analysis of https://www.bbc.co.uk {"mode": "GDPR"}
0.6s	· INFO	MAIN	Chromium launched {"headless": true}
0.6s	· INFO	PREFLIGHT	Navigating to https://www.bbc.co.uk
1.4s	· INFO	PREFLIGHT	Network idle reached
1.8s	▶ STEP	A	Session A start (accept path)
1.9s	· INFO	A	Navigating to https://www.bbc.co.uk
2.8s	· INFO	A	Network idle reached
4.8s	· INFO	A	Capturing pre-consent state
4.9s	· INFO	A	Pre-consent state captured {"pre_consent_cookies": 16, "pre_consent_ad_cookies": 1, "pre_consent_tracking_storage": 0, "pre_consent_tracker_globals": ["analytics"], "pre_consent_unblocked_scripts": 0, "pre_consent_capture_error": null}
5.8s	· INFO	A	Banner: found
6.0s	· INFO	A	Accept All interaction {"cmp": "Sourcepoint", "button_text": "I agree", "clicked": true, "in_iframe": true, "error": null}
8.0s	· INFO	A	Capturing post-accept baseline state
8.4s	· INFO	A	Baseline captured {"baseline_cookies": 34, "baseline_ad_cookies": 5, "baseline_tracking_storage": 0, "baseline_tracker_globals": ["analytics"], "baseline_unblocked_scripts": 8, "baseline_capture_error": null}
9.1s	· INFO	A	Context closed, HAR saved
9.1s	▶ STEP	A	Session A complete {"pre_consent_cookies": 16, "pre_consent_ad_cookies": 1, "pre_consent_tracking_storage": 0, "pre_consent_tracker_globals": ["analytics"], "pre_consent_unblocked_scripts": 0, "pre_consent_capture_error": null, "baseline_cookies": 34, "baseline_ad_cookies": 5, "baseline_tracking_storage": 0, "baseline_tracker_globals": ["analytics"], "baseline_unblocked_scripts": 8, "baseline_capture_error": null}
9.1s	▶ STEP	B	Session B start (reject path)
9.1s	· INFO	B	Navigating to https://www.bbc.co.uk
9.9s	· INFO	B	Network idle reached
11.9s	· INFO	B	Capturing pre-consent state
11.9s	· INFO	B	Pre-consent B captured {"pre_consent_B_cookies": 16, "pre_consent_B_ad_cookies": 1, "pre_consent_B_tracking_storage": 0, "pre_consent_B_tracker_globals": ["analytics"], "pre_consent_B_unblocked_scripts": 0, "pre_consent_B_capture_error": null}
12.8s	· INFO	B	Banner: found
12.8s	· INFO	B	Persistent widget found pre-reject (CMP fully loaded) {"found": true, "text": "(consent widget)", "in_iframe": false}
27.4s	· INFO	B	Click symmetry measured {"accept_clicks": 1, "reject_clicks": 0}
27.6s	· INFO	B	Reject All interaction {"cmp": "Sourcepoint", "button_text": "I do not agree", "clicked": true, "clicks_required": 1, "required_manage_panel": false, "panel_navigated": false, "panel_new_frames": 0, "panel_wait_s": 0.0, "error": null}
29.6s	· INFO	B	Site accessible after reject: True
29.6s	· INFO	B	Capturing post-reject state
29.8s	· INFO	B	Post-reject captured {"post_reject_cookies": 26, "post_reject_ad_cookies": 1, "post_reject_tracking_storage": 0, "post_reject_tracker_globals": ["analytics"], "post_reject_unblocked_scripts": 4, "post_reject_capture_error": null}
29.8s	· INFO	B	Persistent widget check {"found": true, "text": "(consent widget)", "in_iframe": false}
29.8s	· INFO	B	Capturing subpages
33.9s	· INFO	B	2 subpage(s) captured {"urls": ["https://www.bbc.co.uk/aboutthebbc", "https://www.bbc.co.uk/accessibility/"], "errors": []}
34.7s	· INFO	B	Context closed, HAR saved
34.7s	· INFO	B	Checking pre-ticked toggles (separate session)
34.7s	· INFO	B	Navigating to https://www.bbc.co.uk
35.5s	· INFO	B	Network idle reached
53.8s	⚠ WARN	B	Manage/preferences button not visible after 5s wait — toggle check may return 0 results
55.2s	· INFO	B	Pre-ticked toggles: 0 found {"toggles": {}}
55.2s	⚠ WARN	B	Toggle check returned 0 results — diagnostics: {"manage_button_found": false, "manage_button_text": null, "frames_scanned": [], "total_elements_found": 0, "note": "Manage/preferences button not found on page"}
55.2s	▶ STEP	B	Session B complete {"post_reject_cookies": 26, "post_reject_ad_cookies": 1, "post_reject_tracking_storage": 0, "post_reject_tracker_globals": ["analytics"], "post_reject_unblocked_scripts": 4, "post_reject_capture_error": null, "accept_clicks": 1, "reject_clicks": 1, "reject_at_first_screen": true, "subpages_captured": 2}
55.2s	▶ STEP	C	Session C start (persistence check)
55.2s	· INFO	C	Navigating to https://www.bbc.co.uk
56.0s	· INFO	C	Network idle reached
59.1s	· INFO	C	Reject for persistence test {"clicked": true, "error": null}
61.1s	· INFO	C	Opening second tab (same-session test)
61.2s	· INFO	C	Navigating to https://www.bbc.co.uk
61.9s	· INFO	C	Network idle reached
64.4s	· INFO	C	Same-session state captured {"persistence_1_cookies": 25, "persistence_1_ad_cookies": 1, "persistence_1_tracking_storage": 0, "persistence_1_tracker_globals": ["analytics"], "persistence_1_unblocked_scripts": 3, "persistence_1_capture_error": null}
64.7s	· INFO	C	Storage state saved, opening new context
64.9s	· INFO	C	Navigating to https://www.bbc.co.uk
65.6s	· INFO	C	Network idle reached
67.9s	· INFO	C	New-session state captured {"persistence_2_cookies": 25, "persistence_2_ad_cookies": 1, "persistence_2_tracking_storage": 0, "persistence_2_tracker_globals": ["analytics"], "persistence_2_unblocked_scripts": 5, "persistence_2_capture_error": null}
67.9s	▶ STEP	C	Session C complete {"persistence_1_captured": true, "persistence_2_captured": true}
67.9s	▶ STEP	POLICY_RENDER	Rendering cookie policy page in browser
68.0s	· INFO	POLICY_RENDER	Navigating to policy: https://www.bbc.co.uk/cookies
74.2s	· INFO	POLICY_RENDER	Extracted 513 chars from policy page
74.2s	· INFO	POLICY_RENDER	Policy page rendered (513 chars)
74.2s	· INFO	MAIN	Browser closed
74.3s	▶ STEP	DNS	Running CNAME cloaking checks
74.3s	· INFO	DNS	Apex domain: co.uk (from hostname: www.bbc.co.uk)
74.6s	· INFO	DNS	Checking 9 subdomain(s) {"subdomains": ["mybbc-analytics.files.bbci.co.uk", "idcta.api.bbc.co.uk", "static.files.bbci.co.uk", "emp.bbci.co.uk", "static.bbci.co.uk", "bbc.co.uk", "a1.api.bbc.co.uk", "nav.files.bbci.co.uk", "ichef.bbci.co.uk"]}
74.8s	· INFO	DNS	CNAME check done — 0 tracker CNAME(s) {"results": [{"sub": "mybbc-analytics.files.bbci.co.uk", "cname": null, "tracker": false, "vendor": null}, {"sub": "idcta.api.bbc.co.uk", "cname": null, "tracker": false, "vendor": null}, {"sub": "static.files.bbci.co.uk", "cname": null, "tracker": false, "vendor": null}, {"sub": "emp.bbci.co.uk", "cname": null, "tracker": false, "vendor": null}, {"sub": "static.bbci.co.uk", "cname": null, "tracke
74.8s	▶ STEP	POLICY	Fetching cookie policy
74.8s	· INFO	POLICY	Policy found at https://www.bbc.co.uk/cookies
74.8s	· INFO	POLICY	Fetching policy, cross-referencing 35 cookie(s)
85.3s	· INFO	POLICY	Policy fetch OK {"declared": 7, "undeclared_observed": 33, "ai_used": true}
85.3s	⚠ WARN	POLICY	33 cookie(s) not in policy {"cookies": ["__tbc", "__gpi", "_pctx", "_cb_svref", "ckns_policy_exp", "https://www.bbc.com_oeu1775086170103r0.7661490551611259$$27302320011$$session_state", "ckns_policy", "XID", "ckns_explicit", "cX_G", "__gads", "ecos.dt", "ckns_mvt", "ckns_privacy", "usnatUUID", "_pcus", "ckns_eds", "_cb", "IDE", "https://www.bbc.com_oeu1775086177131r0.5938044045327691$$27302320011$$session_state"]}
85.3s	▶ STEP	MAIN	Analysis complete {"error_count": 0}
85.3s	▶ STEP	C1	Running Component 1 HAR analysis
85.7s	· INFO	C1	Phase hint timestamps passed to HAR analyser {"reject_click": "2026-04-01T23:29:54"}
85.7s	· INFO	C1	HAR analysis complete — 6 FAIL item(s) {"total_requests": 369, "phases": ["pre_consent", "post_reject"], "phase_strategy": {"accept": "not_detected", "reject": "url_pattern"}, "fail_items": ["B.1", "E.1", "E.3", "F.1", "G.7", "ADD.2"]}
85.9s	· INFO	C1	Extracted 1 TCF string(s) from accept-path HAR {"purposes_found": ["All 10 core purposes CONSENTED"]}
85.9s	· INFO	C1	Running C1 on accept-path HAR for C.2/C.3 baseline
85.9s	· INFO	C1	Accept-HAR promoted 2 item(s): ['C.2', 'C.3'] {"phases": ["pre_consent", "post_accept"]}
85.9s	▶ STEP	CHECKS	Running browser-state checks
85.9s	· INFO	CHECKS	Browser checks complete — 11 FAIL item(s) {"fail_items": ["B.2", "B.3", "F.2", "G.2", "G.6", "H.1", "I.1", "I.2", "I.3", "L.2", "L.3"], "mode": "gdpr"}

Detailed Findings

B. Pre-Consent State 3 FAIL 2 PASS 0 MANUAL

B.1 No tracking requests before consent banner interaction

✗ FAIL

2 tracking domain(s) made requests before any consent signal was recorded.

domain	vendor	category	request_count	first_request_time	example_url
sb.scorecardresearch.com	Comscore	ANALYTICS	2	2026-04-01T23:29:36	https://sb.scorecardresearch.com/beacon.js
pagead2.googlesyndication.com	Google AdSense/GAM	ADVERTISING	1	2026-04-01T23:29:38	https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Recommendation: Third-party analytics and advertising scripts must not be loaded until after affirmative consent. Implement a consent-gate that defers all non-essential script initialisation until the TCF API reports a positive consent decision.

B.2 No analytics/marketing cookies in Storage pre-consent

✗ FAIL

1 advertising cookie(s) present in browser storage before any consent was given.

name: optimizelyEndUserId · domain: .bbc.com · value snippet: oeu1775086177131r0.5938044045327691

Recommendation: Advertising and analytics cookies must not be set until after the user has given affirmative consent. Verify server-side Set-Cookie logic does not fire before the consent signal is received.

B.3 JS tracker globals return undefined pre-consent

✗ FAIL

Tracker globals defined before consent: ['analytics']

global: analytics · type: __defined_object__

Recommendation: Tracker initialisation scripts must not execute before consent. Implement a consent gate that loads tracker SDKs only after the TCF API confirms a positive decision.

B.4 No tracking identifiers in localStorage/sessionStorage pre-consent

✓ PASS

No tracking keys found in web storage pre-consent.

B.5 Non-essential scripts have type=text/plain (CMP-blocked) in DOM

✓ PASS

All tracking scripts in DOM appear to be CMP-blocked (type=text/plain) or absent.

C. Baseline Capture 0 PASS 0 MANUAL

C.2 Inventory of third-party tracking domains active after Accept All

ℹ INFO

13 tracking domains active after consent-all (baseline).

▶ Show all 13 rows

domain	vendor	category	first_seen	example_url
pub.doubleverify.com	DoubleVerify (brand safety)	MEASUREMENT	2026-04-01T23:29:33	https://pub.doubleverify.com/dvtag/signals/ids/pub.json?ctx=29028254&cmp=DV1298722&url=https%3A%2F%2Fbbc.com&ids=1&token
cm.g.doubleclick.net	Google DoubleClick	ADVERTISING	2026-04-01T23:29:33	https://cm.g.doubleclick.net/partnerpixels?gdpr_consent=CQh-8AAQh-8AAAGABCENCYFgAP_gAEAAABpYIoQJAAFAAVAA4ACAAFQAMgAaAA5A
ep1.adtrafficquality.google	Google SODAR/IVT	ADVERTISING	2026-04-01T23:29:33	https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gpt&tv=m202603240101&st=env&sjk=2769602542085824
securepubads.g.doubleclick.net	Google Publisher Ads	ADVERTISING	2026-04-01T23:29:33	https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2769602542085824&correlator=2690793528291442&eid=31097528%2C3109
11a4d851dcbbfa5f337830877cc0a539.safeframe.googlesyndication.com	Google SafeFrame (viewability)	MEASUREMENT	2026-04-01T23:29:33	https://11a4d851dcbbfa5f337830877cc0a539.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
sb.scorecardresearch.com	Comscore	ANALYTICS	2026-04-01T23:29:33	https://sb.scorecardresearch.com/internal-cs/default/beacon.js
ep2.adtrafficquality.google	Google SODAR/IVT	ADVERTISING	2026-04-01T23:29:33	https://ep2.adtrafficquality.google/sodar/sodar2.js
ib.adnxs.com	Xandr AppNexus	ADVERTISING	2026-04-01T23:29:33	https://ib.adnxs.com/getuidj?gdpr=1&gdpr_consent=CQh-8AAQh-8AAAGABCENCYFgAP_gAEAAABpYIoQJAAFAAVAA4ACAAFQAMgAaAA5AB6AEWAJ
pagead2.googlesyndication.com	Google AdSense/GAM	ADVERTISING	2026-04-01T23:29:33	https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=253&li=gpt_m202603240101&jk=2769602542085824&rc=
cdn.doubleverify.com	DoubleVerify	MEASUREMENT	2026-04-01T23:29:33	https://cdn.doubleverify.com/dvtp_src.js
tps.doubleverify.com	DoubleVerify (brand safety)	MEASUREMENT	2026-04-01T23:29:34	https://tps.doubleverify.com/visit.js?flvr=0&ttmms=77&ttfrms=27&bridua=3&tstype=2&eparams=DC4FC%3Dl9EEADTbpTauTauHHH%5D3
tps-dn-ew1.doubleverify.com	DoubleVerify (brand safety)	MEASUREMENT	2026-04-01T23:29:34	https://tps-dn-ew1.doubleverify.com/event.jpg?impid=8984bf1de8324c0799dc759ce184857a&consid=&api=1&rc=true
tpsc-ew1.doubleverify.com	DoubleVerify (brand safety)	MEASUREMENT	2026-04-01T23:29:34	https://tpsc-ew1.doubleverify.com/event.png?impid=8984bf1de8324c0799dc759ce184857a&flavor=0&gdpr=1&gdpr_consent=CQh-8AAQ

C.3 Full cookie inventory (with expiry, HttpOnly, Secure, SameSite) after Accept All

ℹ INFO

34 cookies in storage after Accept All (full metadata).

▶ Show all 34 rows

name	domain	expires_days	http_only	secure	same_site	classification
ckns_mvt	.bbc.co.uk	365.0	False	True	Lax	UNKNOWN
optimizelyEndUserId	.bbc.com	180.0	False	False	Lax	AD
optimizelySession	.bbc.com	180.0	False	False	Lax	ESSENTIAL
ckns_mvt	.bbc.com	365.0	False	False	Lax	UNKNOWN
https://www.bbc.com_oeu1775086170103r0.7661490551611259$$27302320011$$session_state	a4621041136.cdn.optimizely.com	180.0	False	True	None	ESSENTIAL
ckns_policy	.bbc.com	365.0	False	False	Lax	UNKNOWN
ckns_policy_exp	.bbc.com	365.0	False	False	Lax	UNKNOWN
ckns_explicit	.bbc.com	365.0	False	False	Lax	UNKNOWN
ckns_privacy	.bbc.com	365.0	False	False	Lax	UNKNOWN
_cb	.bbc.com	395.0	False	True	Lax	UNKNOWN
_chartbeat2	.bbc.com	395.0	False	True	Lax	UNKNOWN
_cb_svref	.bbc.com	0.0	False	True	Lax	UNKNOWN
_sp_su	.bbc.com	365.0	False	True	None	ESSENTIAL
_pcid	.bbc.com	395.0	False	True	Lax	UNKNOWN
consentUUID	www.bbc.com	365.0	False	True	None	ESSENTIAL
usnatUUID	.bbc.com	365.0	False	True	None	UNKNOWN
_pctx	.bbc.com	395.0	False	True	Lax	UNKNOWN
_pprv	.bbc.com	395.0	False	True	Lax	UNKNOWN
__tbc	.bbc.com	400.0	False	False	Lax	UNKNOWN
xbc	.bbc.com	400.0	False	False	Lax	UNKNOWN
_pcus	.bbc.com	395.0	False	True	Lax	UNKNOWN
cX_P	.bbc.com	395.0	False	True	Lax	UNKNOWN
permutive-id	.bbc.com	183.0	False	True	None	UNKNOWN
UID	.scorecardresearch.com	390.0	False	True	None	UNKNOWN
XID	.scorecardresearch.com	390.0	False	True	None	UNKNOWN
pxid	.e488cdb0-e7cb-4d91-9648-60d437d8e491.prmutv.co	91.0	True	True	None	UNKNOWN
cX_G	.bbc.com	395.0	False	True	Lax	UNKNOWN
__gads	.bbc.com	390.0	False	True	None	AD
__gpi	.bbc.com	390.0	False	True	None	AD
gckp	.cxense.com	365.0	True	True	None	UNKNOWN
__eoi	.bbc.com	180.0	False	True	None	AD
IDE	.doubleclick.net	390.0	True	True	None	AD
ckns_eds	.www.bbc.com	400.0	False	False	Lax	UNKNOWN
ecos.dt	.www.bbc.com	session	False	False	Lax	UNKNOWN

C.4 Tracker JS globals active after Accept All (baseline)

ℹ INFO

Globals defined after consent: ['analytics']

global: analytics · type: __defined_object__

D. Decline Non-Essential Consent 1 PASS 0 MANUAL

D.4 Reject requires no more clicks than Accept (EDPB symmetry)

✓ PASS

Accept and Reject both require 1 click(s). Symmetric.

accept clicks: 1 · reject clicks: 1 · extra clicks to reject: 0 · reject required manage panel: False

E. Network Request Verification 2 FAIL 2 PASS 0 MANUAL

E.1 No requests to non-essential third-party domains after reject-all

✗ FAIL

13 tracking domain(s) continued firing after reject-all.

▶ Show all 13 rows

domain	vendor	category	request_count	in_baseline	first_seen	example_url
pub.doubleverify.com	DoubleVerify (brand safety)	MEASUREMENT	3	False	2026-04-01T23:29:54	https://pub.doubleverify.com/dvtag/signals/ids/pub.json?ctx=29028254&cmp=DV1298722&url=https%3A%2F%2Fbbc.com&ids=1&token
sb.scorecardresearch.com	Comscore	ANALYTICS	2	False	2026-04-01T23:29:54	https://sb.scorecardresearch.com/internal-cs/default/beacon.js
ep1.adtrafficquality.google	Google SODAR/IVT	ADVERTISING	2	False	2026-04-01T23:29:54	https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gpt&tv=m202603240101&st=env&sjk=7252211227740584
pagead2.googlesyndication.com	Google AdSense/GAM	ADVERTISING	9	False	2026-04-01T23:29:54	https://pagead2.googlesyndication.com/gampad/ads?pvsid=7252211227740584&correlator=22190794992333&eid=31097430&output=ld
a61e8b95a6c4b2cd4f071e5993f576fd.safeframe.googlesyndication.com	Google SafeFrame (viewability)	MEASUREMENT	1	False	2026-04-01T23:29:54	https://a61e8b95a6c4b2cd4f071e5993f576fd.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
ep2.adtrafficquality.google	Google SODAR/IVT	ADVERTISING	3	False	2026-04-01T23:29:54	https://ep2.adtrafficquality.google/sodar/sodar2.js
cdn.doubleverify.com	DoubleVerify	MEASUREMENT	3	False	2026-04-01T23:29:54	https://cdn.doubleverify.com/dvtp_src.js
tps.doubleverify.com	DoubleVerify (brand safety)	MEASUREMENT	1	False	2026-04-01T23:29:55	https://tps.doubleverify.com/visit.js?flvr=0&ttmms=65&ttfrms=24&bridua=3&tstype=2&eparams=DC4FC%3Dl9EEADTbpTauTauHHH%5D3
cm.g.doubleclick.net	Google DoubleClick	ADVERTISING	1	False	2026-04-01T23:29:55	https://cm.g.doubleclick.net/pixel?google_nid=doubleverify_ddp&google_ula=7327243&google_hm=**&google_redir=https%3A%2F%
tps-dn-ew1.doubleverify.com	DoubleVerify (brand safety)	MEASUREMENT	1	False	2026-04-01T23:29:55	https://tps-dn-ew1.doubleverify.com/event.jpg?impid=a14d4c4ff7f64d70bab81daa83c788a4&consid=&api=1&rc=true
tpsc-ew1.doubleverify.com	DoubleVerify (brand safety)	MEASUREMENT	3	False	2026-04-01T23:29:55	https://tpsc-ew1.doubleverify.com/event.png?impid=a14d4c4ff7f64d70bab81daa83c788a4&flavor=0&gdpr=1&gdpr_consent=CQh-8AAQ
securepubads.g.doubleclick.net	Google Publisher Ads	ADVERTISING	1	False	2026-04-01T23:29:55	https://securepubads.g.doubleclick.net/pagead/managed/dict/m202603310101/gpt
ib.adnxs.com	Xandr AppNexus	ADVERTISING	1	False	2026-04-01T23:29:55	https://ib.adnxs.com/setuid?entity=584&code=1f9f90df-bf7e-4d6b-b3f9-ef9f355fc015-tuct10c72ff3&gdpr=1&gdpr_consent=

Recommendation: Ensure Prebid.js, Google Publisher Tags, and all analytics SDKs are gated behind a TCF consent check. Use the __tcfapi('addEventListener') callback and only initialise bidders when gdprApplies=true and purpose consents are granted.

E.2 No tracker JS libraries loaded after reject-all

✓ PASS

No tracker scripts observed post-reject.

E.3 No tracking pixels or beacons fired after reject-all

✗ FAIL

13 tracking pixel/beacon call(s) post-reject.

▶ Show all 13 rows

url	vendor	category	timestamp
https://sb.scorecardresearch.com/internal-cs/default/beacon.js	Comscore	ANALYTICS	2026-04-01T23:29:54
https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gpt&tv=m202603240101&st=env&sjk=7252211227740584	Google SODAR/IVT	ADVERTISING	2026-04-01T23:29:54
https://ep2.adtrafficquality.google/sodar/sodar2.js	Google SODAR/IVT	ADVERTISING	2026-04-01T23:29:54
https://ep2.adtrafficquality.google/sodar/sodar2/253/runner.html	Google SODAR/IVT	ADVERTISING	2026-04-01T23:29:54
https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsu-8wsfxMQJLqNeWfjfa2SnlnqSKOLGKwgaPvoZHYgtwi1T59EclxzJycpeG8GbF	Google AdSense/GAM	ADVERTISING	2026-04-01T23:29:54
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4	Google AdSense/GAM	ADVERTISING	2026-04-01T23:29:55
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWgD	Google AdSense/GAM	ADVERTISING	2026-04-01T23:29:55
https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjss4zSImb491lDGUAgemh_43iEIXXwi91NZsXa5Ns_InIlUPVWmvEsVryZbMtUqtx	Google AdSense/GAM	ADVERTISING	2026-04-01T23:29:55
https://cm.g.doubleclick.net/pixel?google_nid=doubleverify_ddp&google_ula=7327243&google_hm=**&google_redir=https%3A%2F%	Google DoubleClick	ADVERTISING	2026-04-01T23:29:55
https://ep2.adtrafficquality.google/generate_204?qGFJsQ	Google SODAR/IVT	ADVERTISING	2026-04-01T23:29:55
https://pagead2.googlesyndication.com/pagead/ping?e=1	Google AdSense/GAM	ADVERTISING	2026-04-01T23:29:55
https://ep1.adtrafficquality.google/pagead/sodar?id=sodar2&v=253&t=2&li=gpt_m202603240101&jk=7252211227740584&bg=!OzilOF	Google SODAR/IVT	ADVERTISING	2026-04-01T23:29:55
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuFMdROxdrfpl2kIiXYDMqNnEd10PhYHZWylIUSQC8wM7qUof7avSRKa5W	Google AdSense/GAM	ADVERTISING	2026-04-01T23:29:56

E.4 No tracking activity on subpages after reject-all

✓ PASS

No tracker globals or tracking storage observed on 2 subpage(s).

F. Cookie Verification (Third-Party) 2 FAIL 1 PASS 0 MANUAL

F.1 No analytics/marketing cookies present after reject-all

✗ FAIL

1 advertising cookie(s) still being sent in request headers post-reject. Note: HAR does not capture full Storage tab state — use Component 2 for definitive Storage verification.

name: optimizelyEndUserId · domain: gn-web-assets.api.bbc.com · value snippet: oeu1775086177131r0.5938044045327691 · first seen: 2026-04-01T23:29:54

Recommendation: On consent withdrawal, the CMP must delete all non-essential cookies and clear localStorage tracking entries. Implement server-side consent-state awareness to suppress Set-Cookie headers for tracking cookies when no valid consent is stored.

F.2 document.cookie contains only essential cookies post-reject

✗ FAIL

Advertising cookies in document.cookie post-reject: ['optimizelyEndUserId=oeu1775086177131r0.5938044045327691']

doc cookie snippet: optimizelyEndUserId=oeu1775086177131r0.5938044045327691; optimizelySession=1775086177143; ckns_mvt=fe33751a-c4f2-41de-a580-d515b67a64fb; ckns_policy=000; ckns_policy_exp=1775086177567; ckns_explicit=0; ckns_privacy=july2019; _cb=B9IVeiBox9epCnGC6z; _chartbeat2=.1775086177845.1775086177845.1.CqOl1ODByNqAjv014CCsktnBGHwd1.1; _cb_svref=https%3A%2F%2Fwww.bbc.co.uk%2F; _pcid=%7B%22browserId%22%3A%22mng

F.3 No tracking identifiers in web storage post-reject

✓ PASS

No tracking identifiers found in localStorage/sessionStorage post-reject.

G. First-Party Cookie Classification 3 FAIL 5 PASS 0 MANUAL

G.1 Complete first-party cookie inventory with full metadata

ℹ INFO

27 first-party cookies in Storage after Accept All.

▶ Show all 27 rows

name	domain	expires_days	http_only	secure	same_site	classification
optimizelyEndUserId	.bbc.com	180.0	False	False	Lax	AD
optimizelySession	.bbc.com	180.0	False	False	Lax	ESSENTIAL
ckns_mvt	.bbc.com	365.0	False	False	Lax	UNKNOWN
ckns_policy	.bbc.com	365.0	False	False	Lax	UNKNOWN
ckns_policy_exp	.bbc.com	365.0	False	False	Lax	UNKNOWN
ckns_explicit	.bbc.com	365.0	False	False	Lax	UNKNOWN
ckns_privacy	.bbc.com	365.0	False	False	Lax	UNKNOWN
_cb	.bbc.com	395.0	False	True	Lax	UNKNOWN
_chartbeat2	.bbc.com	395.0	False	True	Lax	UNKNOWN
_cb_svref	.bbc.com	0.0	False	True	Lax	UNKNOWN
_sp_su	.bbc.com	365.0	False	True	None	ESSENTIAL
_pcid	.bbc.com	395.0	False	True	Lax	UNKNOWN
consentUUID	www.bbc.com	365.0	False	True	None	ESSENTIAL
usnatUUID	.bbc.com	365.0	False	True	None	UNKNOWN
_pctx	.bbc.com	395.0	False	True	Lax	UNKNOWN
_pprv	.bbc.com	395.0	False	True	Lax	UNKNOWN
__tbc	.bbc.com	400.0	False	False	Lax	UNKNOWN
xbc	.bbc.com	400.0	False	False	Lax	UNKNOWN
_pcus	.bbc.com	395.0	False	True	Lax	UNKNOWN
cX_P	.bbc.com	395.0	False	True	Lax	UNKNOWN
permutive-id	.bbc.com	183.0	False	True	None	UNKNOWN
cX_G	.bbc.com	395.0	False	True	Lax	UNKNOWN
__gads	.bbc.com	390.0	False	True	None	AD
__gpi	.bbc.com	390.0	False	True	None	AD
__eoi	.bbc.com	180.0	False	True	None	AD
ckns_eds	.www.bbc.com	400.0	False	False	Lax	UNKNOWN
ecos.dt	.www.bbc.com	session	False	False	Lax	UNKNOWN

G.2 All observed cookies declared in cookie policy

✗ FAIL

33 cookie(s) observed but not found in cookie policy at https://www.bbc.co.uk/cookies.

▶ Show all 30 rows

cookie_name	status
__tbc	observed but not in cookie policy
__gpi	observed but not in cookie policy
_pctx	observed but not in cookie policy
_cb_svref	observed but not in cookie policy
ckns_policy_exp	observed but not in cookie policy
https://www.bbc.com_oeu1775086170103r0.7661490551611259$$27302320011$$session_state	observed but not in cookie policy
ckns_policy	observed but not in cookie policy
XID	observed but not in cookie policy
ckns_explicit	observed but not in cookie policy
cX_G	observed but not in cookie policy
__gads	observed but not in cookie policy
ecos.dt	observed but not in cookie policy
ckns_mvt	observed but not in cookie policy
ckns_privacy	observed but not in cookie policy
usnatUUID	observed but not in cookie policy
_pcus	observed but not in cookie policy
ckns_eds	observed but not in cookie policy
_cb	observed but not in cookie policy
IDE	observed but not in cookie policy
https://www.bbc.com_oeu1775086177131r0.5938044045327691$$27302320011$$session_state	observed but not in cookie policy
datadome	observed but not in cookie policy
UID	observed but not in cookie policy
optimizelySession	observed but not in cookie policy
_chartbeat2	observed but not in cookie policy
__eoi	observed but not in cookie policy
xbc	observed but not in cookie policy
permutive-id	observed but not in cookie policy
optimizelyEndUserId	observed but not in cookie policy
_pprv	observed but not in cookie policy
cX_P	observed but not in cookie policy

G.3 Strictly necessary two-part test (AI-assisted)

✓ PASS

AI analysis: 0 cookie(s) fail the strictly-necessary test and should be absent after reject-all. Summary:

G.4 Server-side analytics/ad cookies identified in Set-Cookie headers

✓ PASS

No advertising cookies observed in Set-Cookie response headers.

G.5 No CNAME cloaking detected (first-party subdomains resolving to tracker infrastructure)

✓ PASS

No CNAME cloaking detected across 9 subdomain(s).

▶ Show all 9 rows

subdomain	cname_target	is_tracker	vendor	error
mybbc-analytics.files.bbci.co.uk	(no CNAME / A record only)	False	None	None
idcta.api.bbc.co.uk	(no CNAME / A record only)	False	None	None
static.files.bbci.co.uk	(no CNAME / A record only)	False	None	None
emp.bbci.co.uk	(no CNAME / A record only)	False	None	None
static.bbci.co.uk	(no CNAME / A record only)	False	None	None
bbc.co.uk	(no CNAME / A record only)	False	None	None
a1.api.bbc.co.uk	(no CNAME / A record only)	False	None	None
nav.files.bbci.co.uk	(no CNAME / A record only)	False	None	None
ichef.bbci.co.uk	(no CNAME / A record only)	False	None	None

G.6 Non-essential first-party cookies absent after reject-all

✗ FAIL

1 advertising/analytics cookie(s) present in both baseline and post-reject storage.

cookie name: optimizelyEndUserId

G.7 No non-essential Set-Cookie headers after reject-all

✗ FAIL

13 Set-Cookie header(s) for non-essential cookies observed post-reject.

▶ Show all 13 rows

cookie_name	domain	header	classification	timestamp
gckp	p1cluster.cxense.com	gckp=2s3oaip9dhsdzntxliuv8d00e;Path=/;Domain=cxense.com;Expires=Thu, 1 Apr 2027 23:29:54 GMT;Max-Age=31536000;HttpOnly;Secure;Version=1;SameSite=None	UNKNOWN	2026-04-01T23:29:54
gckp	comcluster.cxense.com	gckp=cx:1z6xit8ew47vq3vxrjzqbxotxg:ip6oka985kk8;Path=/;Domain=cxense.com;Expires=Thu, 1 Apr 2027 23:29:55 GMT;Max-Age=31536000;HttpOnly;Secure;Version	UNKNOWN	2026-04-01T23:29:54
gckp	id.cxense.com	gckp=cx:1z6xit8ew47vq3vxrjzqbxotxg:ip6oka985kk8;Path=/;Domain=cxense.com;Expires=Thu, 1 Apr 2027 23:29:55 GMT;Max-Age=31536000;HttpOnly;Secure;Version	UNKNOWN	2026-04-01T23:29:55
datadome	trc.taboola.com	datadome=dK3hpFPgQkWxyoGF~G9EtefTBWGtWg0_xoiY5SqEg6lzhZQdKZ4~CaRhM8lyShemwCa8QLacc2oNYnDShwh0bPBndXxBtcN8W1l2cOJ4uIjPRWo4zz3PEGZHK2kNGPXZ; Path=/; Dom	UNKNOWN	2026-04-01T23:29:55
api_uid	www.temu.com	api_uid=CnAQJ2nNqnPDT1XA4DftAg==; Secure; Path=/; Domain=temu.com; Expires=Thu, 01 Apr 2027 23:29:55 GMT	UNKNOWN	2026-04-01T23:29:55
DotMetrics.DeviceKey	uk-script.dotmetrics.net	DotMetrics.DeviceKey=DeviceID=; expires=Thu, 01 Apr 2027 23:29:56 GMT; domain=.dotmetrics.net; path=/; SameSite=None; secure	UNKNOWN	2026-04-01T23:29:56
DotMetrics.UniqueUserIdentityCookie	uk-script.dotmetrics.net	DotMetrics.UniqueUserIdentityCookie=UserID=63545c67-ebd1-48ea-9918-37fe862a96c0&Created=04/01/2026 23:29:56&UserMode=0&guid=c5df64a2-7164-45d9-b650-ae	UNKNOWN	2026-04-01T23:29:56
DotMetrics.DeviceKey	uk-script.dotmetrics.net	DotMetrics.DeviceKey=DeviceID=; expires=Thu, 01 Apr 2027 23:29:56 GMT; domain=.dotmetrics.net; path=/; SameSite=None; secure	UNKNOWN	2026-04-01T23:29:56
DotMetrics.UniqueUserIdentityCookie	uk-script.dotmetrics.net	DotMetrics.UniqueUserIdentityCookie=UserID=63545c67-ebd1-48ea-9918-37fe862a96c0&Created=04/01/2026 23:29:56&UserMode=0&guid=c5df64a2-7164-45d9-b650-ae	UNKNOWN	2026-04-01T23:29:56
DotMetrics.DeviceKey	uk-script.dotmetrics.net	DotMetrics.DeviceKey=DeviceID=; expires=Thu, 01 Apr 2027 23:29:58 GMT; domain=.dotmetrics.net; path=/; SameSite=None; secure	UNKNOWN	2026-04-01T23:29:58
DotMetrics.UniqueUserIdentityCookie	uk-script.dotmetrics.net	DotMetrics.UniqueUserIdentityCookie=UserID=63545c67-ebd1-48ea-9918-37fe862a96c0&Created=04/01/2026 23:29:56&UserMode=0&guid=c5df64a2-7164-45d9-b650-ae	UNKNOWN	2026-04-01T23:29:58
DotMetrics.DeviceKey	uk-script.dotmetrics.net	DotMetrics.DeviceKey=DeviceID=; expires=Thu, 01 Apr 2027 23:29:58 GMT; domain=.dotmetrics.net; path=/; SameSite=None; secure	UNKNOWN	2026-04-01T23:29:58
DotMetrics.UniqueUserIdentityCookie	uk-script.dotmetrics.net	DotMetrics.UniqueUserIdentityCookie=UserID=63545c67-ebd1-48ea-9918-37fe862a96c0&Created=04/01/2026 23:29:56&UserMode=0&guid=c5df64a2-7164-45d9-b650-ae	UNKNOWN	2026-04-01T23:29:58

Recommendation: Backend services must be aware of consent state. Identity tokens and advertising identifiers must not be set or refreshed via server-side Set-Cookie after a reject-all signal has been recorded.

G.8 Cookie lifetime analysis (ITP bypass detection)

✓ PASS

No obvious ITP bypass patterns in Set-Cookie headers.

G.9 No tracking keys in first-party localStorage/sessionStorage post-reject

✓ PASS

No tracking identifiers found in first-party web storage post-reject.

H. JS Global Object Verification 1 FAIL 1 PASS 0 MANUAL

H.1 Tracker JS globals (ga, gtag, fbq, hj, etc.) return undefined post-reject

✗ FAIL

Tracker globals still defined after reject-all: ['analytics']

global: analytics · type: __defined_object__

H.2 Tracker globals not merely defined without values

ℹ INFO

See H.1 — same evidence applies.

global: analytics · present: True

H.3 window.dataLayer absent or contains no tracking events post-reject

✓ PASS

dataLayer not present post-reject.

I. DOM / Source Inspection 3 FAIL 0 PASS 0 MANUAL

I.1 Tracker script tags have type=text/plain (CMP-blocked) in DOM post-reject

✗ FAIL

4 tracker script(s) in DOM without CMP type-blocking post-reject. 0 script(s) correctly blocked.

src	type_attr	vendor
https://securepubads.g.doubleclick.net/tag/js/gpt.js	text/javascript	Google Publisher Ads
https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202603240101/pubads_impl.js?cb=3109743		Google Publisher Ads
https://pub.doubleverify.com/dvtag/29028254/DV1298722/pub.js	text/javascript	DoubleVerify (brand safety)
https://sb.scorecardresearch.com/internal-cs/default/beacon.js	text/javascript	Comscore

I.2 Non-essential scripts blocked (type=text/plain)

✗ FAIL

See I.1 — same check.

src	type_attr	vendor
https://securepubads.g.doubleclick.net/tag/js/gpt.js	text/javascript	Google Publisher Ads
https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202603240101/pubads_impl.js?cb=3109743		Google Publisher Ads
https://pub.doubleverify.com/dvtag/29028254/DV1298722/pub.js	text/javascript	DoubleVerify (brand safety)
https://sb.scorecardresearch.com/internal-cs/default/beacon.js	text/javascript	Comscore

I.3 No tracker JS files in executed sources post-reject

✗ FAIL

Based on DOM script inventory; full Sources tab verification requires Chrome DevTools protocol introspection (beyond current scope).

src	type_attr	vendor
https://securepubads.g.doubleclick.net/tag/js/gpt.js	text/javascript	Google Publisher Ads
https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202603240101/pubads_impl.js?cb=3109743		Google Publisher Ads
https://pub.doubleverify.com/dvtag/29028254/DV1298722/pub.js	text/javascript	DoubleVerify (brand safety)
https://sb.scorecardresearch.com/internal-cs/default/beacon.js	text/javascript	Comscore

J. Safari-Specific Considerations 1 PASS 2 MANUAL

J.1 ITP setting

☐ MANUAL

Requires manual browser configuration check.

J.2 ITP-off re-test

☐ MANUAL

Requires manual browser configuration check.

J.3 Server-side cookie-setting identified where ITP would block client-side

✓ PASS

No obvious ITP-bypass server-side cookies detected.

K. Consent Mechanism UX Compliance 3 PASS 2 MANUAL

K.1 Reject All at same prominence and level as Accept All

✓ PASS

Reject All available at first screen at same level as Accept All.

accept visible at first screen: True · reject visible at first screen: True · reject requires extra layer: False · accept button text: I agree · reject button text: I do not agree

K.2 Non-essential categories default to OFF

☐ MANUAL

Could not open preferences panel to check toggles.

K.3 No dark patterns in consent banner (colour, visual hierarchy)

☐ MANUAL

DOM-level button detection completed. Full visual assessment of colour contrast, typography prominence, and deceptive visual hierarchy requires screenshot review. See screenshots in report.

K.5 Persistent consent withdrawal mechanism accessible after interaction

✓ PASS

Persistent consent widget found: '(consent widget)'

found: True · text: (consent widget) · in iframe: False

K.6 Site fully accessible after declining consent (no cookie wall)

✓ PASS

Site content accessible after declining consent.

accessible: True

L. Consent State Persistence 2 FAIL 0 PASS 0 MANUAL

L.2 Consent choice respected on second tab (same session)

✗ FAIL

Advertising cookies found in second tab — consent state may not be persisted.

consent cookie found: True · ad cookies found: True · tcf available: True · tcf display status: None

L.3 Declined state maintained after closing and reopening (simulate new session)

✗ FAIL

Advertising cookies found on return — consent state not correctly maintained.

ad cookies on return: True · total cookies: 25

Additional Findings 1 FAIL 3 PASS 0 MANUAL

ADD.1 Persistent identifier bridging across consent states

✓ PASS

No persistent cross-phase identifiers detected in POST bodies.

ADD.2 TCF consent string analysis (all phases)

✗ FAIL

Found 1 unique TCF strings. 1 reject-all string(s) transmitted to RTB/ad vendors — transmission itself is a processing act.

phase	domain	timestamp	summary	is_reject_all	is_accept_all	cmp	tcf_policy_version	purpose_consents	li_claims	decode_error
post_accept	cm.g.doubleclick.net	2026-04-01T23:29:33	Accept-all (purposes 1–10 consented, CMP: Sourcepoint Technologies)	False	True	Sourcepoint Technologies	5	All 10 core purposes CONSENTED	[2]	None
post_reject	pagead2.googlesyndication.com	2026-04-01T23:29:54	Reject-all (no purpose consents)	True	False	Sourcepoint Technologies	5	All 24 purposes REJECTED (no consents)	none	None

Recommendation: Under IAB TCF 2.2 Policy §2, initiating a bid request is itself a processing activity. Even with a reject-all TC string, the act of calling out to DSPs/SSPs transmits personal data (IP address, user agent, page URL). Bid requests must be suppressed entirely when GDPR applies and no consent is given.

ADD.3 Session ID bridging across consent and rejection phases

✓ PASS

No session ID bridging detected across consent states.

ADD.4 Persistent vendor userIds transmitted after reject-all

✓ PASS

No persistent vendor userIds detected in post-reject requests.

Test Details 0 PASS 0 MANUAL

META Site URL, test date, CMP platform

ℹ INFO

CMP identified as: Sourcepoint CMP

url	Accessibility - BBC
test date	2026-04-01
test time utc	2026-04-01T23:29:35
cmp detected	Sourcepoint CMP
total requests	369
phases detected	pre_consentpost_reject
phase strategy	{'accept': 'not_detected', 'reject': 'url_pattern'}

run_id: f3331e88 · raw log · ⬇ report JSON · all runs · ← Home

🤖 AI-Enhanced Analysis

Add regulatory citations, risk ratings, enforcement precedents, and a remediation roadmap using Claude AI. Results are cached — generation only runs once per report.

🤖 View AI Report