Sample report

Sample report: a real shop scan, name removed

This is what untick sends after a scan. A real European menswear shop on OneTrust was scanned on 26 October 2026: trackers before consent, tracking after Reject, a missing withdrawal link and six accessibility issues, each with evidence, the rule behind it and a fix. Only the shop’s name, addresses and screenshots were removed.

See the 168-shop study

Checked 26 Oct 11:56 · 5 pages · seen from NL

Scan your own shop

D48/100

Start with the critical ones.

Grade D: risky.

Partial result

Oct 26, 2026, 11:56 AM
Desktop visitor
Browser ran in the Netherlands
88% checked · 1 not checked
Automatic accessibility checks 92/100 · 6 issues · 27 checks need a person
7 trackers before consent
Consent banner found · OneTrust

5 problems, most serious first

Showing all areas

Critical

Trackers fire before consent

What happened

+3.3sMicrosoft Claritya.clarity.ms
+3.3sGoogle Analyticsregion1.analytics.google.com
+3.3sGoogle Ads / DoubleClickstats.g.doubleclick.net
+3.3sGoogle Adswww.googleadservices.com
+3.3sGoogle Ads conversionwww.google.com
+4.9sTikTok Pixelanalytics.tiktok.com
+5.1sMeta Pixelwww.facebook.com

Microsoft Clarity, Google Analytics, Google Ads / DoubleClick, Google Ads and 5 more were active before any consent. The first request fired 3.3s after the page loaded.

Tracking cookies set before consent

__kla_idwww.northline-shop.example
_ga_XXXXXXXX.www.northline-shop.example
_ga.www.northline-shop.example
_gcl_au.www.northline-shop.example
_ttp.www.northline-shop.example
_fbp.www.northline-shop.example
MUID.bing.com
MUID.clarity.ms

Our browser ran on Cloudflare's network in the Netherlands. Sites that look up a visitor's country may place it elsewhere, often the United States.

Google Consent Mode reports consent as already granted before any choice (region1.analytics.google.com/g/collect · gcs=G111 · gcd=13t3tPt2t5l1). Set the defaults to “denied” for EU and UK visitors.

How to untick it

OneTrust

For OneTrust:

Mark each tracking tag with its OneTrust category (snippet below).
Using Google tags? Turn on Google Consent Mode in your template.
Load the OneTrust script first in your page head.

Hold a tag until its category is accepted (checked against OneTrust docs, October 2026)html

<!-- Checked against OneTrust docs, October 2026 -->
<!-- https://my.onetrust.com/s/article/UUID-518074a1-a6da-81c3-be52-bae7685d9c94 -->
<!-- C0002 = performance, C0004 = targeting -->
<script type="text/plain" class="optanon-category-C0004"
  src="https://example-tracker.com/pixel.js"></script>

Official docs

Block analytics and ad tags until consent is given.
In Google Tag Manager, fire marketing tags on a consent trigger instead of “All Pages”.
Move hard-coded pixels (Meta, TikTok, LinkedIn) into the consent-gated tag manager.
Re-scan to confirm nothing loads before the banner is answered.

Google Consent Mode v2 (default denied)html

<!-- 1. Put this BEFORE your Google tag / Tag Manager snippet -->
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('consent', 'default', {
    ad_storage: 'denied',
    ad_user_data: 'denied',
    ad_personalization: 'denied',
    analytics_storage: 'denied',
    wait_for_update: 500
  });
</script>

<!-- 2. Call this only when the visitor clicks "Accept" -->
<script>
  gtag('consent', 'update', {
    ad_storage: 'granted',
    ad_user_data: 'granted',
    ad_personalization: 'granted',
    analytics_storage: 'granted'
  });
</script>

Meta Pixel: wait for consentjs

// Before fbq('init', ...): start with consent revoked
fbq('consent', 'revoke');
fbq('init', 'YOUR_PIXEL_ID');
fbq('track', 'PageView'); // queued, not sent until consent

// In your banner's "Accept" handler:
fbq('consent', 'grant');

TikTok Pixel: hold consentjs

// Right after the TikTok base code loads
ttq.holdConsent();

// In your banner's "Accept" handler:
ttq.grantConsent();
// …and in "Reject":
ttq.revokeConsent();

Gate any hard-coded taghtml

<!-- Hard-coded tags: don't let the browser run them until consent -->
<script type="text/plain" data-consent="marketing" src="https://example-tracker.com/pixel.js"></script>

<script>
  // Call after the visitor accepts marketing cookies
  function enableConsentedScripts(category) {
    document.querySelectorAll('script[type="text/plain"][data-consent="' + category + '"]').forEach(function (old) {
      var s = document.createElement('script');
      if (old.src) s.src = old.src; else s.textContent = old.textContent;
      old.replaceWith(s);
    });
  }
</script>

Why it matters

In the EU, non-essential cookies and trackers need prior consent.

ePrivacy Directive Art. 5(3): cookies need prior consent GDPR Art. 4(11), 6 & 7: valid consent UK GDPR & PECR Reg. 6

Read the rule page

Automated checks from a fresh browser running on Cloudflare in the Netherlands, with European language and time settings, scanning 5 pages. untick flags risk and gives evidence; it isn’t legal advice.

Sample report

Questions about this report

Is this a real untick report?

Yes. It is a real scan from 26 October 2026 of a European menswear shop that uses OneTrust. We removed the shop’s name, its addresses and the screenshots. The findings, the trackers, their timings and the fixes are exactly what the scanner recorded on that day.

What did the scan find on this shop?

Seven trackers sent data before the visitor made any choice, and tracking carried on after Reject. There was no easy way to change your mind, no withdrawal link was found, and analytics cookies were set to last longer than 13 months. The accessibility check found six issues.

Why does the report say “partial result”?

Some steps could not be checked on this shop, so untick says so instead of counting them as passed. The What we checked tab lists every page and step, with the ones we could not run marked. A low problem count on a partial result is never treated as a pass.

How do I get a report like this for my own shop?

Enter your homepage address in the free scan on the untick homepage. It takes about a minute and needs no signup. The free result lists every problem it finds; a free account adds the evidence, a fix written for your consent tool and a monthly re-check.

Find out what your website does with “no”

Start with your homepage. Get the evidence. No signup required.

Scan your website free