About the report: This is an automated technical spot check of the front page at the stated time and in the stated test environment. The report does not determine breaches of law, controllership, or whether consent was legally required in the specific situation. Contact with a third party does not by itself document storage, collection or processing of personal data. Priority indicates the technical need for follow-up, not legal severity. The result may contain errors or be affected by geography, A/B testing, login and the scanner's detection. Findings and the absence of findings must be verified manually before being passed on or acted upon.
Consent solution: Cookiebot (Usercentrics) (found via selector, global, script)
| Technical priority | Observation | State | Confidence |
|---|---|---|---|
| Medium priority | Trustpilot widget loaded (library only) before consent choice (1 requests) In a fresh browser with no stored consent, Trustpilot widget's script was loaded 1 time(s) on page load. No collection calls or cookies observed — the library may be inactive until consent is given, but loading before choice is still a point for improvement. Category: functional. Contact with a third party does not by itself document storage or processing of personal data, but should be investigated.
https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js
Suggestion: Load the service only after consent (Consent Mode default denied / GTM trigger on consent event / CMP categorisation). |
Before choice | medium |
| High priority | Microsoft Clarity contacted before consent choice (5 requests) In a fresh browser with no stored consent, Microsoft Clarity was contacted 5 time(s) on page load. Category: statistics. Contact with a third party does not by itself document storage or processing of personal data, but should be investigated.
https://www.clarity.ms/tag/tc2tzfuxo8?ref=gtm
Suggestion: Load the service only after consent (Consent Mode default denied / GTM trigger on consent event / CMP categorisation). |
Before choice | high |
| Very high priority | TikTok Pixel contacted before consent choice (11 requests) In a fresh browser with no stored consent, TikTok Pixel was contacted 11 time(s) on page load, and set cookies. Category: marketing. Contact with a third party does not by itself document storage or processing of personal data, but should be investigated.
https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=CPFF28JC77U5SPBHFQCG&lib=ttq
Storage: Set-Cookie: _ttp
Suggestion: Load the service only after consent (Consent Mode default denied / GTM trigger on consent event / CMP categorisation). |
Before choice | high |
| Very high priority | Snap Pixel contacted before consent choice (5 requests) In a fresh browser with no stored consent, Snap Pixel was contacted 5 time(s) on page load, and set cookies. Category: marketing. Contact with a third party does not by itself document storage or processing of personal data, but should be investigated.
https://sc-static.net/scevent.min.js
Storage: Set-Cookie: X-AB
Suggestion: Load the service only after consent (Consent Mode default denied / GTM trigger on consent event / CMP categorisation). |
Before choice | high |
| High priority | Meta Pixel (Facebook) contacted before consent choice (3 requests) In a fresh browser with no stored consent, Meta Pixel (Facebook) was contacted 3 time(s) on page load. Category: marketing. Contact with a third party does not by itself document storage or processing of personal data, but should be investigated.
https://connect.facebook.net/en_US/fbevents.js
Suggestion: Load the service only after consent (Consent Mode default denied / GTM trigger on consent event / CMP categorisation). |
Before choice | high |
| Info | Google Analytics 4: cookieless Consent Mode pings before choice (1 requests, gcs=G100) The requests carry a consent signal showing “denied” and set no cookies. This is expected behaviour in Google/Microsoft Consent Mode (advanced). Note: advanced mode still means contact with a third party before choice; whether that is desirable is a policy decision for the site owner.
https://region1.google-analytics.com/g/collect?v=2&tid=G-29S1WCMZH7>m=%5Bmaskert%5D&_p=1787239078749&gcs=G100&gcd=13p3p3p2p5l1&npa=1&dma_cps=-&dma=1&gdid=dMWZhNz&ecid=%5Bmaskert%5D&_eu=AAAAAGAC&are=1&cid=%5Bmaskert%5D&ec_mode=a&frm=0&pscdl=denied&rcb=7&sr=1366x900&uaa=x86&uab=64&uafvl=%5Bmaskert%5…
|
Before choice | high |
| Info | Google Ads / DoubleClick: cookieless Consent Mode pings before choice (1 requests, gcs=G100) The requests carry a consent signal showing “denied” and set no cookies. This is expected behaviour in Google/Microsoft Consent Mode (advanced). Note: advanced mode still means contact with a third party before choice; whether that is desirable is a policy decision for the site owner.
https://pagead2.googlesyndication.com/ccm/collect?rcb=7&frm=0&apvc=1&tid=%5Bmaskert%5D&en=page_view&dl=https%3A%2F%2Feksempel-nettbutikk.no&scrsrc=www.googletagmanager.com&rnd=%5Bmaskert%5D&navt=n&npa=1&us_privacy=1---&did=dMWZhNz&gdid=dMWZhNz&_tu=CA>m=%5Bmaskert%5D&gcs=G100&gcd=13p3p3p2p5l1&dma_cps=-&dma…
|
Before choice | high |
| High priority | Pinterest Tag contacted before consent choice (3 requests) In a fresh browser with no stored consent, Pinterest Tag was contacted 3 time(s) on page load. Category: marketing. Contact with a third party does not by itself document storage or processing of personal data, but should be investigated.
https://ct.pinterest.com/user/?tid=%5Bmaskert%5D&pd=%7B%22np%22%3A%22gtm%22%2C%22gtm_version%22%3A%22legacy%22%7D&cb=%5Bmaskert%5D&dep=2%2CPAGE_LOAD
Suggestion: Load the service only after consent (Consent Mode default denied / GTM trigger on consent event / CMP categorisation). |
Before choice | high |
| High priority | 25 cookies the scanner did not classify as necessary, set before choice (known tracker/third-party cookies: X-AB, _ttp, _tt_enable_cookie, _ttp, _pin_unauth) The following cookies (beyond those the scanner classifies as necessary/CMP-technical) were set before any choice: X-AB (sc-static.net), sc_site (eksempel-nettbutikk.no), __rutmb (.eksempel-nettbutikk.no), __ruid (.eksempel-nettbutikk.no), sc_5re8FfzfAPDge34zK1C7H2 (.eksempel-nettbutikk.no), neo_sc (.eksempel-nettbutikk.no), nt_user_id (.eksempel-nettbutikk.no), nt_trait (.eksempel-nettbutikk.no), nt_group_id (.eksempel-nettbutikk.no), nt_group_trait (.eksempel-nettbutikk.no), nt_anonymous_id (.eksempel-nettbutikk.no), nt_page_init_referrer (.eksempel-nettbutikk.no), nt_page_init_referring_domain (.eksempel-nettbutikk.no), neo_session (.eksempel-nettbutikk.no), _ttp (.tiktok.com). The classification is verified manually.
Storage: X-AB, sc_site, __rutmb, __ruid, sc_5re8FfzfAPDge34zK1C7H2, neo_sc, nt_user_id, nt_trait, nt_group_id, nt_group_trait, nt_anonymous_id, nt_page_init_referrer, nt_page_init_referring_domain, neo_session, _ttp
|
Before choice | high |
| High priority | TikTok Pixel contacted after confirmed rejection (4 requests) After clicking reject (cookiebot:#CybotCookiebotDialogBodyButtonDecline), TikTok Pixel was still contacted. This is the kind of observation that should be investigated first.
https://analytics.tiktok.com/api/v2/pixel/act
Suggestion: Check that reject actually updates the consent state and that the tags listen to it (GTM consent checks / blocklist). |
Reject all | high |
| High priority | Meta Pixel (Facebook) contacted after confirmed rejection (1 requests) After clicking reject (cookiebot:#CybotCookiebotDialogBodyButtonDecline), Meta Pixel (Facebook) was still contacted. This is the kind of observation that should be investigated first.
https://www.facebook.com/tr/
Suggestion: Check that reject actually updates the consent state and that the tags listen to it (GTM consent checks / blocklist). |
Reject all | high |
| High priority | Snap Pixel contacted after confirmed rejection (1 requests) After clicking reject (cookiebot:#CybotCookiebotDialogBodyButtonDecline), Snap Pixel was still contacted. This is the kind of observation that should be investigated first.
https://tr.snapchat.com/p
Suggestion: Check that reject actually updates the consent state and that the tags listen to it (GTM consent checks / blocklist). |
Reject all | high |
| High priority | Microsoft Clarity contacted after confirmed rejection (2 requests) After clicking reject (cookiebot:#CybotCookiebotDialogBodyButtonDecline), Microsoft Clarity was still contacted. This is the kind of observation that should be investigated first.
https://h.clarity.ms/collect
Suggestion: Check that reject actually updates the consent state and that the tags listen to it (GTM consent checks / blocklist). |
Reject all | high |
GCM: present (default denied) · TCF: no · localStorage: 13 keys
| Service | Category (scanner classification) | Often requires consent | Requests |
|---|---|---|---|
| TikTok Pixel | marketing | yes | 11 |
| Microsoft Clarity | statistics | yes | 5 |
| Snap Pixel | marketing | yes | 5 |
| Meta Pixel (Facebook) | marketing | yes | 3 |
| Pinterest Tag | marketing | yes | 3 |
| Trustpilot widget | functional | yes | 1 |
| Google Analytics 4 | statistics | yes | 1 |
| Google Ads / DoubleClick | marketing | yes | 1 |
| ellinorassetsblobs-g9c2h2ddefgrcrgg.z02.azurefd.net | – | no | 93 |
| edge.sitecorecloud.io | – | no | 43 |
| (first party) | – | no | 39 |
| static.itxuc.com | – | no | 6 |
| Cookiebot (CMP) | cmp | no | 5 |
| edge-platform.sitecorecloud.io | – | no | 5 |
| jsDelivr CDN | necessary | no | 3 |
| services14.itxuc.com | – | no | 3 |
| Google gtag.js (bibliotek) | tag_manager | no | 2 |
| s.pinimg.com | – | no | 2 |
| cdn.flbx.io | – | no | 2 |
| discover-euc1.sitecorecloud.io | – | no | 2 |
| services.itxuc.com | – | no | 1 |
| Google Tag Manager | tag_manager | no | 1 |
| gateway.getflowbox.com | – | no | 1 |
| www.merchant-center-analytics.goog | – | no | 1 |
| cdn.adt376.net | – | no | 1 |
| Name | Domain | Lifetime |
|---|---|---|
| X-AB | sc-static.net | 1 d |
| sc_site | eksempel-nettbutikk.no | session |
| JSESSIONID | services.itxuc.com | session |
| __cf_bm | .sitecorecloud.io | 0 d |
| __rutmb | .eksempel-nettbutikk.no | 0 d |
| __ruid | .eksempel-nettbutikk.no | 0 d |
| sc_5re8FfzfAPDge34zK1C7H2 | .eksempel-nettbutikk.no | 400 d |
| neo_sc | .eksempel-nettbutikk.no | 365 d |
| nt_user_id | .eksempel-nettbutikk.no | 365 d |
| nt_trait | .eksempel-nettbutikk.no | 365 d |
| nt_group_id | .eksempel-nettbutikk.no | 365 d |
| nt_group_trait | .eksempel-nettbutikk.no | 365 d |
| nt_anonymous_id | .eksempel-nettbutikk.no | 365 d |
| nt_page_init_referrer | .eksempel-nettbutikk.no | 365 d |
| nt_page_init_referring_domain | .eksempel-nettbutikk.no | 365 d |
| neo_session | .eksempel-nettbutikk.no | 365 d |
| _ttp | .tiktok.com | 90 d |
| __rutma | .eksempel-nettbutikk.no | 0 d |
| _scid | .eksempel-nettbutikk.no | 395 d |
| _scid_r | .eksempel-nettbutikk.no | 395 d |
| _tt_enable_cookie | .eksempel-nettbutikk.no | 90 d |
| _ttp | .eksempel-nettbutikk.no | 90 d |
| _pin_unauth | .eksempel-nettbutikk.no | 365 d |
| ttcsid | .eksempel-nettbutikk.no | 90 d |
| ttcsid_CPFF28JC77U5SPBHFQCG | .eksempel-nettbutikk.no | 90 d |
| ttcsid_CR7C2VRC77U8CDVOALMG | .eksempel-nettbutikk.no | 90 d |
| _fbp | .eksempel-nettbutikk.no | 90 d |
(removed in the example report)
Interaction: clicked cookiebot:#CybotCookiebotDialogBodyButtonDecline
GCM: present (default denied) · TCF: no · localStorage: 6 keys
| Service | Category (scanner classification) | Often requires consent | Requests |
|---|---|---|---|
| TikTok Pixel | marketing | yes | 15 (4 after choice) |
| Microsoft Clarity | statistics | yes | 7 (2 after choice) |
| Snap Pixel | marketing | yes | 6 (1 after choice) |
| Meta Pixel (Facebook) | marketing | yes | 4 (1 after choice) |
| Pinterest Tag | marketing | yes | 3 (0 after choice) |
| Trustpilot widget | functional | yes | 1 (0 after choice) |
| Google Analytics 4 | statistics | yes | 1 (0 after choice) |
| Google Ads / DoubleClick | marketing | yes | 1 (0 after choice) |
| ellinorassetsblobs-g9c2h2ddefgrcrgg.z02.azurefd.net | – | no | 93 (0 after choice) |
| edge.sitecorecloud.io | – | no | 42 (0 after choice) |
| (first party) | – | no | 39 (0 after choice) |
| Cookiebot (CMP) | cmp | no | 8 (3 after choice) |
| static.itxuc.com | – | no | 6 (0 after choice) |
| edge-platform.sitecorecloud.io | – | no | 5 (0 after choice) |
| jsDelivr CDN | necessary | no | 3 (0 after choice) |
| services14.itxuc.com | – | no | 3 (0 after choice) |
| Google gtag.js (bibliotek) | tag_manager | no | 2 (0 after choice) |
| s.pinimg.com | – | no | 2 (0 after choice) |
| cdn.flbx.io | – | no | 2 (0 after choice) |
| discover-euc1.sitecorecloud.io | – | no | 2 (0 after choice) |
| services.itxuc.com | – | no | 1 (0 after choice) |
| Google Tag Manager | tag_manager | no | 1 (0 after choice) |
| gateway.getflowbox.com | – | no | 1 (0 after choice) |
| www.merchant-center-analytics.goog | – | no | 1 (0 after choice) |
| cdn.adt376.net | – | no | 1 (0 after choice) |
| Name | Domain | Lifetime |
|---|---|---|
| X-AB | sc-static.net | 1 d |
| sc_site | eksempel-nettbutikk.no | session |
| JSESSIONID | services.itxuc.com | session |
| __cf_bm | .sitecorecloud.io | 0 d |
| _ttp | .tiktok.com | 90 d |
| CookieConsent | eksempel-nettbutikk.no | 365 d |
| ttcsid_CPFF28JC77U5SPBHFQCG | .eksempel-nettbutikk.no | 90 d |
| ttcsid | .eksempel-nettbutikk.no | 90 d |
| ttcsid_CR7C2VRC77U8CDVOALMG | .eksempel-nettbutikk.no | 90 d |
(removed in the example report)
Interaction: clicked cookiebot:#CybotCookiebotDialogBodyLevelButtonLevelOptinAllowAll
GCM: present (default denied) · TCF: no · localStorage: 12 keys
| Service | Category (scanner classification) | Often requires consent | Requests |
|---|---|---|---|
| TikTok Pixel | marketing | yes | 15 (4 after choice) |
| Microsoft Clarity | statistics | yes | 9 (4 after choice) |
| Google Ads / DoubleClick | marketing | yes | 7 (6 after choice) |
| Snap Pixel | marketing | yes | 6 (1 after choice) |
| Meta Pixel (Facebook) | marketing | yes | 4 (1 after choice) |
| Pinterest Tag | marketing | yes | 3 (0 after choice) |
| Google Analytics 4 | statistics | yes | 2 (1 after choice) |
| Trustpilot widget | functional | yes | 1 (0 after choice) |
| ellinorassetsblobs-g9c2h2ddefgrcrgg.z02.azurefd.net | – | no | 93 (0 after choice) |
| edge.sitecorecloud.io | – | no | 43 (0 after choice) |
| (first party) | – | no | 39 (0 after choice) |
| Cookiebot (CMP) | cmp | no | 8 (3 after choice) |
| static.itxuc.com | – | no | 6 (0 after choice) |
| edge-platform.sitecorecloud.io | – | no | 5 (0 after choice) |
| jsDelivr CDN | necessary | no | 3 (0 after choice) |
| services14.itxuc.com | – | no | 3 (0 after choice) |
| www.google.com | – | no | 3 (3 after choice) |
| www.google.fi | – | no | 3 (3 after choice) |
| Google gtag.js (bibliotek) | tag_manager | no | 2 (0 after choice) |
| s.pinimg.com | – | no | 2 (0 after choice) |
| cdn.flbx.io | – | no | 2 (0 after choice) |
| discover-euc1.sitecorecloud.io | – | no | 2 (0 after choice) |
| www.merchant-center-analytics.goog | – | no | 2 (1 after choice) |
| services.itxuc.com | – | no | 1 (0 after choice) |
| Google Tag Manager | tag_manager | no | 1 (0 after choice) |
| gateway.getflowbox.com | – | no | 1 (0 after choice) |
| cdn.adt376.net | – | no | 1 (0 after choice) |
| c.bing.com | – | no | 1 (1 after choice) |
| Name | Domain | Lifetime |
|---|---|---|
| X-AB | sc-static.net | 1 d |
| sc_site | eksempel-nettbutikk.no | session |
| __cf_bm | .sitecorecloud.io | 0 d |
| JSESSIONID | services.itxuc.com | session |
| _ttp | .tiktok.com | 90 d |
| _tt_enable_cookie | .eksempel-nettbutikk.no | 90 d |
| _ttp | .eksempel-nettbutikk.no | 90 d |
| _scid | .eksempel-nettbutikk.no | 395 d |
| _scid_r | .eksempel-nettbutikk.no | 395 d |
| _pin_unauth | .eksempel-nettbutikk.no | 365 d |
| _fbp | .eksempel-nettbutikk.no | 90 d |
| CookieConsent | eksempel-nettbutikk.no | 365 d |
| _clck | .eksempel-nettbutikk.no | 365 d |
| _clsk | .eksempel-nettbutikk.no | 1 d |
| _ga | .eksempel-nettbutikk.no | 400 d |
| _gcl_au | .eksempel-nettbutikk.no | 90 d |
| _ga_ZYX9M2J914 | .eksempel-nettbutikk.no | 400 d |
| _ga_29S1WCMZH7 | .eksempel-nettbutikk.no | 400 d |
| test_cookie | .doubleclick.net | 0 d |
| MUID | .bing.com | 390 d |
| MR | .c.bing.com | 7 d |
| SRM_B | .c.bing.com | 390 d |
| SM | .c.clarity.ms | session |
| MUID | .clarity.ms | 390 d |
| MR | .c.clarity.ms | 7 d |
| ANONCHK | .c.clarity.ms | 0 d |
| ttcsid_CPFF28JC77U5SPBHFQCG | .eksempel-nettbutikk.no | 90 d |
| ttcsid | .eksempel-nettbutikk.no | 90 d |
| ttcsid_CR7C2VRC77U8CDVOALMG | .eksempel-nettbutikk.no | 90 d |
(removed in the example report)