This is an anonymised sample of a ConsentScan report. Domain and findings are fictional but representative of a real scan.
← Back to consentscan.io
ConsentScan

Cookie compliance report

GDPR & ePrivacy scan · sample

Generated 19 September 2026
at 10:14
F

acme-health.ie

Scanned on 19 Sept 2026, 10:14 · Verdict: fail · Score: 18/100

What to change (in order)

  1. Gate Google Analytics (GA4) behind consent. In your OneTrust dashboard, move the GA4 tag from category “C0001 Strictly Necessary” to “C0002 Performance” and ensure GTM only fires the tag on the corresponding consent event.
  2. Gate Meta Pixel + Google Ads. Same fix path in OneTrust: assign to “C0004 Targeting” and update GTM triggers to require the “OneTrust GroupsUpdated” event containing that category.
  3. Move Hotjar to explicit opt-in. Load its script only after consent, either via GTM (recommended) or by wrapping the snippet with a consent check.
11
Cookies
9
High severity
1
Medium severity
4
Pages scanned
Consent Management Platform: OneTrust (installed but not blocking cookies)

Cookies detected (11)

Analytics 5 · Advertising 5 · Necessary 1
CookieVendorCategorySeverityParty
_ga
.acme-health.ie
Google Analytics 4AnalyticsHigh1st party
_ga_9K3H2X7L
.acme-health.ie
Google Analytics 4AnalyticsHigh1st party
_gid
.acme-health.ie
Google AnalyticsAnalyticsHigh1st party
_gat_UA
.acme-health.ie
Google AnalyticsAnalyticsHigh1st party
_gcl_au
.acme-health.ie
Google AdsAdvertisingHigh1st party
_fbp
.acme-health.ie
Facebook PixelAdvertisingHigh1st party
IDE
.doubleclick.net
Google DoubleClickAdvertisingHigh3rd party
test_cookie
.doubleclick.net
Google DoubleClickAdvertisingHigh3rd party
_uetsid
.acme-health.ie
Microsoft (Bing UET)AdvertisingHigh1st party
_hjSessionUser_1234
.acme-health.ie
HotjarAnalyticsMedium1st party
__cf_bm
.acme-health.ie
Cloudflare (bot protection)NecessaryNecessary1st party

Pages scanned

Methodology

ConsentScan loads the homepage plus internal subpages in a headless Chromium browser and inspects every cookie set before any user interaction. Under GDPR and the ePrivacy Directive, non-essential cookies (analytics, advertising, personalisation) must wait for opt-in consent. The grade (A–F) reflects the number of non-compliant cookies and third-party trackers found; a pass verdict indicates zero non-essential cookies fired before consent.

ConsentScan · a product of Cycubix Ltd · Dublin, Ireland
This report is a diagnostic aid, not legal advice. Consult a data protection professional for compliance sign-off.
consentscan.io