Sample report: technical consent report (anonymised real test)
At a glance
- What and when?
- Automated test of an anonymised homepage on 20 August 2026 at 15:18 UTC, before a choice, after rejection and after acceptance.
- What was observed?
- 13 technical observations. The report recorded, among other things, contact with services before a choice and after rejection. See the details for state, storage and uncertainty.
- Follow up first
- Investigate observations after rejection and check that rejection was actually recorded. Establish what the requests contain and the purposes of the services.
- Recommendation
- Have the website operator review the configuration manually. Fix any consent-dependent tags running without permission, then repeat the test.
- Automated or manual?
- The observations are automated. No manual or legal review of this sample test is documented. Contact alone does not establish a legal violation; absence of findings does not constitute legal approval.
About the report: This is an automated technical spot check of the homepage at the stated time and in the stated test environment. The report does not establish legal violations, controller responsibility or whether consent was legally required in the specific situation. Contact with a third party alone does not document storage, collection or processing of personal data. Priority indicates technical follow-up needs, not legal severity. The result may contain errors or be affected by geography, A/B testing, login and scanner detection. Findings and their absence must be verified manually before sharing or taking action.
Consent solution: Cookiebot (Usercentrics) (found via selector, global, script)
Technical observations (13) · Very high priority: 2 · High priority: 8 · Medium priority: 1 · Info: 2
| Technical priority | Observation | State | Confidence |
|---|---|---|---|
| Medium priority | Trustpilot widget loaded (library only) before a consent choice (1 request) In a fresh browser without stored consent, the Trustpilot widget script loaded once at page load. No collection calls or cookies were observed. The library may remain inactive until consent, but loading before a choice is still an improvement point. Category: functional. Contact with a third party alone does not document storage or processing of personal data, but should be investigated.
https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js
Suggestion: Load the service only after consent (Consent Mode default denied / GTM trigger on consent event / CMP categorisation). |
Before a choice | medium |
| High priority | Microsoft Clarity contacted before a consent choice (5 requests) In a fresh browser without stored consent, Microsoft Clarity was contacted 5 time(s) at page load. Category: statistics. Contact with a third party alone does not document storage or processing of personal data, but should be investigated.
https://www.clarity.ms/tag/tc2tzfuxo8?ref=gtm
Suggestion: Load the service only after consent (Consent Mode default denied / GTM trigger on consent event / CMP categorisation). |
Before a choice | high |
| Very high priority | TikTok Pixel contacted before a consent choice (11 requests) In a fresh browser without stored consent, TikTok Pixel was contacted 11 time(s) at page load, and set cookies. Category: marketing. Contact with a third party alone does not document storage or processing of personal data, but should be investigated.
https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=CPFF28JC77U5SPBHFQCG&lib=ttq
Storage: Set-Cookie: _ttp
Suggestion: Load the service only after consent (Consent Mode default denied / GTM trigger on consent event / CMP categorisation). |
Before a choice | high |
| Very high priority | Snap Pixel contacted before a consent choice (5 requests) In a fresh browser without stored consent, Snap Pixel was contacted 5 time(s) at page load, and set cookies. Category: marketing. Contact with a third party alone does not document storage or processing of personal data, but should be investigated.
https://sc-static.net/scevent.min.js
Storage: Set-Cookie: X-AB
Suggestion: Load the service only after consent (Consent Mode default denied / GTM trigger on consent event / CMP categorisation). |
Before a choice | high |
| High priority | Meta Pixel (Facebook) contacted before a consent choice (3 requests) In a fresh browser without stored consent, Meta Pixel (Facebook) was contacted 3 time(s) at page load. Category: marketing. Contact with a third party alone does not document storage or processing of personal data, but should be investigated.
https://connect.facebook.net/en_US/fbevents.js
Suggestion: Load the service only after consent (Consent Mode default denied / GTM trigger on consent event / CMP categorisation). |
Before a choice | high |
| Info | Google Analytics 4: cookieless Consent Mode pings before a choice (1 request, gcs=G100) The calls carry a consent signal indicating “denied” and set no cookies. This is expected behaviour in Google/Microsoft Consent Mode (advanced). Note: advanced mode still involves contact with third parties before a choice; whether this is desirable is a policy decision for the website owner.
https://region1.google-analytics.com/g/collect?v=2&tid=G-29S1WCMZH7>m=%5Bmaskert%5D&_p=1787239078749&gcs=G100&gcd=13p3p3p2p5l1&npa=1&dma_cps=-&dma=1&gdid=dMWZhNz&ecid=%5Bmaskert%5D&_eu=AAAAAGAC&are=1&cid=%5Bmaskert%5D&ec_mode=a&frm=0&pscdl=denied&rcb=7&sr=1366x900&uaa=x86&uab=64&uafvl=%5Bmaskert%5…
|
Before a choice | high |
| Info | Google Ads / DoubleClick: cookieless Consent Mode pings before a choice (1 request, gcs=G100) The calls carry a consent signal indicating “denied” and set no cookies. This is expected behaviour in Google/Microsoft Consent Mode (advanced). Note: advanced mode still involves contact with third parties before a choice; whether this is desirable is a policy decision for the website owner.
https://pagead2.googlesyndication.com/ccm/collect?rcb=7&frm=0&apvc=1&tid=%5Bmaskert%5D&en=page_view&dl=https%3A%2F%2Feksempel-nettbutikk.no&scrsrc=www.googletagmanager.com&rnd=%5Bmaskert%5D&navt=n&npa=1&us_privacy=1---&did=dMWZhNz&gdid=dMWZhNz&_tu=CA>m=%5Bmaskert%5D&gcs=G100&gcd=13p3p3p2p5l1&dma_cps=-&dma…
|
Before a choice | high |
| High priority | Pinterest Tag contacted before a consent choice (3 requests) In a fresh browser without stored consent, Pinterest Tag was contacted 3 time(s) at page load. Category: marketing. Contact with a third party alone does not document storage or processing of personal data, but should be investigated.
https://ct.pinterest.com/user/?tid=%5Bmaskert%5D&pd=%7B%22np%22%3A%22gtm%22%2C%22gtm_version%22%3A%22legacy%22%7D&cb=%5Bmaskert%5D&dep=2%2CPAGE_LOAD
Suggestion: Load the service only after consent (Consent Mode default denied / GTM trigger on consent event / CMP categorisation). |
Before a choice | high |
| High priority | 25 cookies not classified as necessary by the scanner, set before a choice (known tracking/third-party cookies: X-AB, _ttp, _tt_enable_cookie, _ttp, _pin_unauth) The following cookies (beyond those classified as necessary/CMP-technical by the scanner) were set before any choice: X-AB (sc-static.net), sc_site (eksempel-nettbutikk.no), __rutmb (.eksempel-nettbutikk.no), __ruid (.eksempel-nettbutikk.no), sc_5re8FfzfAPDge34zK1C7H2 (.eksempel-nettbutikk.no), neo_sc (.eksempel-nettbutikk.no), nt_user_id (.eksempel-nettbutikk.no), nt_trait (.eksempel-nettbutikk.no), nt_group_id (.eksempel-nettbutikk.no), nt_group_trait (.eksempel-nettbutikk.no), nt_anonymous_id (.eksempel-nettbutikk.no), nt_page_init_referrer (.eksempel-nettbutikk.no), nt_page_init_referring_domain (.eksempel-nettbutikk.no), neo_session (.eksempel-nettbutikk.no), _ttp (.tiktok.com). The classification is verified manually.
Storage: X-AB, sc_site, __rutmb, __ruid, sc_5re8FfzfAPDge34zK1C7H2, neo_sc, nt_user_id, nt_trait, nt_group_id, nt_group_trait, nt_anonymous_id, nt_page_init_referrer, nt_page_init_referring_domain, neo_session, _ttp
|
Before a choice | high |
| High priority | TikTok Pixel contacted after confirmed rejection (4 requests) After clicking reject (cookiebot:#CybotCookiebotDialogBodyButtonDecline), TikTok Pixel was still contacted. This is the type of observation that should be investigated first.
https://analytics.tiktok.com/api/v2/pixel/act
Suggestion: Check that rejection actually updates the consent state and that tags listen to it (GTM consent checks / blocklist). |
Reject all | high |
| High priority | Meta Pixel (Facebook) contacted after confirmed rejection (1 requests) After clicking reject (cookiebot:#CybotCookiebotDialogBodyButtonDecline), Meta Pixel (Facebook) was still contacted. This is the type of observation that should be investigated first.
https://www.facebook.com/tr/
Suggestion: Check that rejection actually updates the consent state and that tags listen to it (GTM consent checks / blocklist). |
Reject all | high |
| High priority | Snap Pixel contacted after confirmed rejection (1 requests) After clicking reject (cookiebot:#CybotCookiebotDialogBodyButtonDecline), Snap Pixel was still contacted. This is the type of observation that should be investigated first.
https://tr.snapchat.com/p
Suggestion: Check that rejection actually updates the consent state and that tags listen to it (GTM consent checks / blocklist). |
Reject all | high |
| High priority | Microsoft Clarity contacted after confirmed rejection (2 requests) After clicking reject (cookiebot:#CybotCookiebotDialogBodyButtonDecline), Microsoft Clarity was still contacted. This is the type of observation that should be investigated first.
https://h.clarity.ms/collect
Suggestion: Check that rejection actually updates the consent state and that tags listen to it (GTM consent checks / blocklist). |
Reject all | high |
Details by test state
Before a choice: completed · 240 requests · 27 cookies · 8.5 s
GCM: present (default denied) · TCF: no · localStorage: 13 keys
Services/hosts
| Service | Category (scanner classification) | Often requires consent | Requests |
|---|---|---|---|
| TikTok Pixel | marketing | yes | 11 |
| Microsoft Clarity | statistics | yes | 5 |
| Snap Pixel | marketing | yes | 5 |
| Meta Pixel (Facebook) | marketing | yes | 3 |
| Pinterest Tag | marketing | yes | 3 |
| Trustpilot widget | functional | yes | 1 |
| Google Analytics 4 | statistics | yes | 1 |
| Google Ads / DoubleClick | marketing | yes | 1 |
| ellinorassetsblobs-g9c2h2ddefgrcrgg.z02.azurefd.net | · | no | 93 |
| edge.sitecorecloud.io | · | no | 43 |
| (first party) | · | no | 39 |
| static.itxuc.com | · | no | 6 |
| Cookiebot (CMP) | cmp | no | 5 |
| edge-platform.sitecorecloud.io | · | no | 5 |
| jsDelivr CDN | necessary | no | 3 |
| services14.itxuc.com | · | no | 3 |
| Google gtag.js (library) | tag manager | no | 2 |
| s.pinimg.com | · | no | 2 |
| cdn.flbx.io | · | no | 2 |
| discover-euc1.sitecorecloud.io | · | no | 2 |
| services.itxuc.com | · | no | 1 |
| Google Tag Manager | tag manager | no | 1 |
| gateway.getflowbox.com | · | no | 1 |
| www.merchant-center-analytics.goog | · | no | 1 |
| cdn.adt376.net | · | no | 1 |
Cookies (name, domain and lifetime. Values are never shown)
| Name | Domain | Lifetime |
|---|---|---|
| X-AB | sc-static.net | 1 d |
| sc_site | eksempel-nettbutikk.no | session |
| JSESSIONID | services.itxuc.com | session |
| __cf_bm | .sitecorecloud.io | 0 d |
| __rutmb | .eksempel-nettbutikk.no | 0 d |
| __ruid | .eksempel-nettbutikk.no | 0 d |
| sc_5re8FfzfAPDge34zK1C7H2 | .eksempel-nettbutikk.no | 400 d |
| neo_sc | .eksempel-nettbutikk.no | 365 d |
| nt_user_id | .eksempel-nettbutikk.no | 365 d |
| nt_trait | .eksempel-nettbutikk.no | 365 d |
| nt_group_id | .eksempel-nettbutikk.no | 365 d |
| nt_group_trait | .eksempel-nettbutikk.no | 365 d |
| nt_anonymous_id | .eksempel-nettbutikk.no | 365 d |
| nt_page_init_referrer | .eksempel-nettbutikk.no | 365 d |
| nt_page_init_referring_domain | .eksempel-nettbutikk.no | 365 d |
| neo_session | .eksempel-nettbutikk.no | 365 d |
| _ttp | .tiktok.com | 90 d |
| __rutma | .eksempel-nettbutikk.no | 0 d |
| _scid | .eksempel-nettbutikk.no | 395 d |
| _scid_r | .eksempel-nettbutikk.no | 395 d |
| _tt_enable_cookie | .eksempel-nettbutikk.no | 90 d |
| _ttp | .eksempel-nettbutikk.no | 90 d |
| _pin_unauth | .eksempel-nettbutikk.no | 365 d |
| ttcsid | .eksempel-nettbutikk.no | 90 d |
| ttcsid_CPFF28JC77U5SPBHFQCG | .eksempel-nettbutikk.no | 90 d |
| ttcsid_CR7C2VRC77U8CDVOALMG | .eksempel-nettbutikk.no | 90 d |
| _fbp | .eksempel-nettbutikk.no | 90 d |
Screenshot
(removed from the sample report)
Reject all: completed · 250 requests · 9 cookies · 15.9 s
Interaction: clicked cookiebot:#CybotCookiebotDialogBodyButtonDecline
GCM: present (default denied) · TCF: no · localStorage: 6 keys
Services/hosts
| Service | Category (scanner classification) | Often requires consent | Requests |
|---|---|---|---|
| TikTok Pixel | marketing | yes | 15 (4 after a choice) |
| Microsoft Clarity | statistics | yes | 7 (2 after a choice) |
| Snap Pixel | marketing | yes | 6 (1 after a choice) |
| Meta Pixel (Facebook) | marketing | yes | 4 (1 after a choice) |
| Pinterest Tag | marketing | yes | 3 (0 after a choice) |
| Trustpilot widget | functional | yes | 1 (0 after a choice) |
| Google Analytics 4 | statistics | yes | 1 (0 after a choice) |
| Google Ads / DoubleClick | marketing | yes | 1 (0 after a choice) |
| ellinorassetsblobs-g9c2h2ddefgrcrgg.z02.azurefd.net | · | no | 93 (0 after a choice) |
| edge.sitecorecloud.io | · | no | 42 (0 after a choice) |
| (first party) | · | no | 39 (0 after a choice) |
| Cookiebot (CMP) | cmp | no | 8 (3 after a choice) |
| static.itxuc.com | · | no | 6 (0 after a choice) |
| edge-platform.sitecorecloud.io | · | no | 5 (0 after a choice) |
| jsDelivr CDN | necessary | no | 3 (0 after a choice) |
| services14.itxuc.com | · | no | 3 (0 after a choice) |
| Google gtag.js (library) | tag manager | no | 2 (0 after a choice) |
| s.pinimg.com | · | no | 2 (0 after a choice) |
| cdn.flbx.io | · | no | 2 (0 after a choice) |
| discover-euc1.sitecorecloud.io | · | no | 2 (0 after a choice) |
| services.itxuc.com | · | no | 1 (0 after a choice) |
| Google Tag Manager | tag manager | no | 1 (0 after a choice) |
| gateway.getflowbox.com | · | no | 1 (0 after a choice) |
| www.merchant-center-analytics.goog | · | no | 1 (0 after a choice) |
| cdn.adt376.net | · | no | 1 (0 after a choice) |
Cookies (name, domain and lifetime. Values are never shown)
| Name | Domain | Lifetime |
|---|---|---|
| X-AB | sc-static.net | 1 d |
| sc_site | eksempel-nettbutikk.no | session |
| JSESSIONID | services.itxuc.com | session |
| __cf_bm | .sitecorecloud.io | 0 d |
| _ttp | .tiktok.com | 90 d |
| CookieConsent | eksempel-nettbutikk.no | 365 d |
| ttcsid_CPFF28JC77U5SPBHFQCG | .eksempel-nettbutikk.no | 90 d |
| ttcsid | .eksempel-nettbutikk.no | 90 d |
| ttcsid_CR7C2VRC77U8CDVOALMG | .eksempel-nettbutikk.no | 90 d |
Screenshot
(removed from the sample report)
Accept all: completed · 268 requests · 29 cookies · 16.0 s
Interaction: clicked cookiebot:#CybotCookiebotDialogBodyLevelButtonLevelOptinAllowAll
GCM: present (default denied) · TCF: no · localStorage: 12 keys
Services/hosts
| Service | Category (scanner classification) | Often requires consent | Requests |
|---|---|---|---|
| TikTok Pixel | marketing | yes | 15 (4 after a choice) |
| Microsoft Clarity | statistics | yes | 9 (4 after a choice) |
| Google Ads / DoubleClick | marketing | yes | 7 (6 after a choice) |
| Snap Pixel | marketing | yes | 6 (1 after a choice) |
| Meta Pixel (Facebook) | marketing | yes | 4 (1 after a choice) |
| Pinterest Tag | marketing | yes | 3 (0 after a choice) |
| Google Analytics 4 | statistics | yes | 2 (1 after a choice) |
| Trustpilot widget | functional | yes | 1 (0 after a choice) |
| ellinorassetsblobs-g9c2h2ddefgrcrgg.z02.azurefd.net | · | no | 93 (0 after a choice) |
| edge.sitecorecloud.io | · | no | 43 (0 after a choice) |
| (first party) | · | no | 39 (0 after a choice) |
| Cookiebot (CMP) | cmp | no | 8 (3 after a choice) |
| static.itxuc.com | · | no | 6 (0 after a choice) |
| edge-platform.sitecorecloud.io | · | no | 5 (0 after a choice) |
| jsDelivr CDN | necessary | no | 3 (0 after a choice) |
| services14.itxuc.com | · | no | 3 (0 after a choice) |
| www.google.com | · | no | 3 (3 after a choice) |
| www.google.fi | · | no | 3 (3 after a choice) |
| Google gtag.js (library) | tag manager | no | 2 (0 after a choice) |
| s.pinimg.com | · | no | 2 (0 after a choice) |
| cdn.flbx.io | · | no | 2 (0 after a choice) |
| discover-euc1.sitecorecloud.io | · | no | 2 (0 after a choice) |
| www.merchant-center-analytics.goog | · | no | 2 (1 after a choice) |
| services.itxuc.com | · | no | 1 (0 after a choice) |
| Google Tag Manager | tag manager | no | 1 (0 after a choice) |
| gateway.getflowbox.com | · | no | 1 (0 after a choice) |
| cdn.adt376.net | · | no | 1 (0 after a choice) |
| c.bing.com | · | no | 1 (1 after a choice) |
Cookies (name, domain and lifetime. Values are never shown)
| Name | Domain | Lifetime |
|---|---|---|
| X-AB | sc-static.net | 1 d |
| sc_site | eksempel-nettbutikk.no | session |
| __cf_bm | .sitecorecloud.io | 0 d |
| JSESSIONID | services.itxuc.com | session |
| _ttp | .tiktok.com | 90 d |
| _tt_enable_cookie | .eksempel-nettbutikk.no | 90 d |
| _ttp | .eksempel-nettbutikk.no | 90 d |
| _scid | .eksempel-nettbutikk.no | 395 d |
| _scid_r | .eksempel-nettbutikk.no | 395 d |
| _pin_unauth | .eksempel-nettbutikk.no | 365 d |
| _fbp | .eksempel-nettbutikk.no | 90 d |
| CookieConsent | eksempel-nettbutikk.no | 365 d |
| _clck | .eksempel-nettbutikk.no | 365 d |
| _clsk | .eksempel-nettbutikk.no | 1 d |
| _ga | .eksempel-nettbutikk.no | 400 d |
| _gcl_au | .eksempel-nettbutikk.no | 90 d |
| _ga_ZYX9M2J914 | .eksempel-nettbutikk.no | 400 d |
| _ga_29S1WCMZH7 | .eksempel-nettbutikk.no | 400 d |
| test_cookie | .doubleclick.net | 0 d |
| MUID | .bing.com | 390 d |
| MR | .c.bing.com | 7 d |
| SRM_B | .c.bing.com | 390 d |
| SM | .c.clarity.ms | session |
| MUID | .clarity.ms | 390 d |
| MR | .c.clarity.ms | 7 d |
| ANONCHK | .c.clarity.ms | 0 d |
| ttcsid_CPFF28JC77U5SPBHFQCG | .eksempel-nettbutikk.no | 90 d |
| ttcsid | .eksempel-nettbutikk.no | 90 d |
| ttcsid_CR7C2VRC77U8CDVOALMG | .eksempel-nettbutikk.no | 90 d |
Screenshot
(removed from the sample report)