consentglass · GDPR scanner for websites

www.cloudflare.com

Checked on 8/30/2026 · https://www.cloudflare.com/

A
96 / 100
Cookie banner: OneTrust · Privacy-policy link: yes · Legal-notice link: no

No critical items in the delivered HTML · to review: 1.

How is the score calculated? (100 starting points)
Tag manager: Google Tag Manager-12
Cookie banner detected (OneTrust)+8
Result96 / 100

Multiple services of the same kind count on a sliding scale. The score is a guide, not a legal verdict.

What this scan doesn't see consentglass reads only the first, unmodified HTML — without executing JavaScript. Because a cookie banner (OneTrust) is active, the actual trackers almost always load only afterwards and don't appear here. A tag manager is embedded — which services it loads is decided only in the browser. So a good result here doesn't automatically mean “GDPR-compliant”. Monitoring runs the full test with JavaScript enabled.

Cookies set on first load: __cf_bm

Findings

To review

Cookie banner detected ({cmp}) — does it load before consent anyway?

A banner is embedded. Whether the services really load only after consent cannot be determined conclusively from the initial HTML.

What you should do: Test it yourself: open the page in a private window, developer tools → “Network”, reload and see whether e.g. google-analytics appears before a click on “Accept”. Monitoring does this test automatically.

Next steps

  1. Cookie banner detected ({cmp}) — does it load before consent anyway?. Test it yourself: open the page in a private window, developer tools → “Network”, reload and see whether e.g. google-analytics appears before a click on “Accept”. Monitoring does this test automatically.

Third parties detected (1)

ServicePurposeVendorCountryLegal basis
Google Tag Manager
www.googletagmanager.com		 loads further scripts — content depends on the configuration unknown ? Consent required once it loads non-essential items
Monitor this URL automatically?

Weekly re-scan, email as soon as a new tracker appears — coming soon.

Method & limits

On 8/30/2026 we checked the HTML that www.cloudflare.com delivers on first load without a login (normal desktop browser, EU location). Detected: services embedded in the source (scripts, stylesheets, iframes, pixels), a cookie banner based on known providers, cookies from the server response, and links to the privacy policy and legal notice.

Not checked: anything that loads only via JavaScript, content behind a login, subpages, behaviour after clicking “Accept”/“Reject”, server locations and data-processing agreements. The result is an automated snapshot and not a substitute for legal advice.

Scan another website