Recognised tracking cookie in a captured page response without a supported consent signal
ShipReady found a recognised tracking-cookie name in a Set-Cookie header on the captured successful page response and did not find a supported consent-mechanism signal in the available evidence.
Why it matters
A recognised tracking identifier in a response header is useful to review alongside the product's intended consent and tag-loading design.
How ShipReady detects it
What it inspects
ShipReady reads Set-Cookie header names from the final successful page response and recognises a fixed set of analytics and advertising cookie names and prefixes. Cookie values are not retained.
ShipReady also reads static fetch-bearing markup, executable inline code, static markup identity values, and captured response cookie names for its supported consent-mechanism signals. It does not execute scripts or use browser storage.
What triggers a finding
The rule triggers when a recognised tracking-cookie name appears in a Set-Cookie header and no supported consent-mechanism signal is found in the available evidence. Session, authentication, and similar security-cookie names are excluded.
What the evidence shows
The named response header was observed by ShipReady, and the scanner did not find one of its supported consent-mechanism signals in the evidence it inspected.
Limits of this check
ShipReady does not establish whether the cookie persisted in browser storage, whether tracking code ran, whether a consent interface was displayed, or whether a visitor accepted or rejected anything. It does not inspect redirect-hop headers, later JavaScript changes, or legal compliance. A truncated page can limit the static evidence available to the consent classifier.
How to fix it
Identify the integration that sets the cookie
Trace the reported cookie name to its analytics, advertising, tag-management, or other integration and confirm that it is intentional.
Review the intended loading design
Configure and test the integration according to the product's intended consent and tag-loading design, including the states the product actually supports.
How to verify the change
Verify the intended browser flow
Use a clean browser profile and network inspection to compare response headers and storage across the product's available consent states.
Expected: The observed cookie behavior matches the product's intended design.