Does avaa.io use cookies?

avaa.io uses 8 cookies, 2 of which are set by third-party domains. The site uses Cookiebot as its consent management platform.

Does avaa.io use a cookie banner (CMP)?

Yes. avaa.io uses Cookiebot as its consent management platform. IAB TCF v2.3 was not detected. Google Consent Mode v2 appears to be configured.

Which third-party trackers does avaa.io use?

avaa.io loads 22 third-party requests from 10 vendors, including ContentSquare, Google LLC, HubSpot, Font Awesome, HubSpot Inc..

How many marketing and analytics cookies does avaa.io set?

avaa.io sets 0 marketing and 2 analytics cookies, alongside 5 strictly necessary cookies. Under GDPR and the ePrivacy Directive, non-essential cookies require prior consent.

avaa.io

Item: avaa.io
Rating: 49
Author: Passiro

https://avaa.io

Last scanned August 9, 2026

A cookie scan of avaa.io performed on August 9, 2026 found 8 cookies and 22 third-party tracking requests. The assessment covered 10 pages across 10 unique page templates. The site uses Cookiebot as its consent management platform with Google Consent Mode v2; IAB TCF v2.3 was not observed. 22 third-party requests were detected from 10 vendors.

Claim & unlock

Third-party

Trackers

Vendors

Consent banner

Cookiebot

Scans

What this setup is missing

No Reject option on the first layer; declining requires extra steps.

Compliance by audience

European Union

✗ Not met

GDPR + ePrivacy · Prior consent (opt-in)

United Kingdom

✗ Not met

UK GDPR + PECR · Consent-based

United States

✓ Meets this model

CCPA/CPRA + state laws · Notice & opt-out

Canada

! Needs attention

PIPEDA + Québec Law 25 · Consent-based

Brazil

! Needs attention

LGPD · Consent-based

Scanned from the EU; sites may serve different banners or tracking to other regions. Verdicts reflect observed behaviour measured against each audience's rules.

Connection security

HTTPS supported

✓

Redirects HTTP to HTTPS

✓

HSTS

✓

Content Security Policy

✓

Cookies

8 cookies detected: 5 necessary, 2 analytics, 0 marketing, 2 third-party

Total

Necessary

Functional

Analytics

Marketing

Unknown

2 third-party cookies detected

Third-party cookies require explicit user consent under GDPR/ePrivacy.

Filter by category

Name	Domain	Category	Provider	Expiry	Secure	HttpOnly	Party
_hjSessionUser_4988186 before consent	.avaa.io	Analytics	Hotjar	320 d	✓	–	1st
_hjSession_4988186 before consent	.avaa.io	Analytics	Hotjar	Expired	✓	–	1st
XSRF-TOKEN	app.avaa.io	Necessary	CSRF Protection	Expired	✓	–	1st
_cfuvid	.fennoa.com	Necessary	Cloudflare	Session	✓	✓	3rd
_cfuvid	.avaa.io	Necessary	Cloudflare	Session	✓	✓	1st
__cf_bm	.fennoa.com	Necessary	Cloudflare	Expired	✓	✓	3rd
__cf_bm	.avaa.io	Necessary	Cloudflare	Expired	✓	✓	1st
appavaaio_session before consent	app.avaa.io	Unknown	-	Expired	✓	✓	1st

Browser storage set by the site

Name	Domain	Party
_hjLocalStorageTest set by script.hotjar.com/modules.75bf3488a101739acfe9.js:2:217208	https://avaa.io	1st	before consent
_hjSessionStorageTest set by script.hotjar.com/modules.75bf3488a101739acfe9.js:2:217433	https://avaa.io	1st	before consent
hjViewportId set by script.hotjar.com/modules.75bf3488a101739acfe9.js:2:80297	https://avaa.io	1st	before consent
hjActiveViewportIds set by script.hotjar.com/modules.75bf3488a101739acfe9.js:2:80433	https://avaa.io	1st	before consent

Third-Party Trackers

22 requests detected from 10 vendors: ContentSquare, Google LLC, HubSpot, Font Awesome, HubSpot Inc....

Analytics

Marketing

Necessary

Functional

Other

Vendor	Category	Type	Domain
ContentSquare before consent ContentSquare tracker domain (source: Disconnect.me, category: Analytics)	Analytics	script	static.hotjar.com
ContentSquare before consent ContentSquare tracker domain (source: Disconnect.me, category: Analytics)	Analytics	script	content.hotjar.io
Google LLC before consent Google Tag Manager	Analytics	script	www.googletagmanager.com
HubSpot before consent HubSpot tracker domain (source: Disconnect.me, category: Content)	Analytics	script	forms-eu1.hsforms.com
HubSpot before consent HubSpot tracker domain (source: Disconnect.me, category: Analytics)	Analytics	script	js-eu1.hs-analytics.net
HubSpot before consent HubSpot tracker domain (source: Disconnect.me, category: Content)	Analytics	script	perf-eu1.hsforms.com
Font Awesome before consent Font Awesome CDN: icon font and CSS delivery	Functional	script	use.fontawesome.com
HubSpot before consent HubSpot tracker domain (source: Disconnect.me, category: Advertising)	Marketing	script	js-eu1.hs-banner.com
HubSpot before consent HubSpot tracker domain (source: Disconnect.me, category: Advertising)	Marketing	script	js-eu1.hsadspixel.net
HubSpot Inc. before consent HubSpot marketing & CRM	Marketing	script	js-eu1.hubspot.com
HubSpot Inc. before consent HubSpot marketing & CRM	Marketing	script	app-eu1.hubspot.com
LinkedIn Corporation before consent LinkedIn platform widgets	Marketing	script	platform.linkedin.com
Meta Platforms, Inc. before consent Facebook SDK / Pixel	Marketing	script	connect.facebook.net
X Corp (Twitter) before consent X/Twitter platform widgets	Marketing	script	platform.twitter.com
Cybot A/S (Cookiebot) Cookiebot consent management	Necessary	script	consent.cookiebot.com
Google LLC Google Fonts stylesheet	Necessary	script	fonts.googleapis.com
Google LLC Google Fonts files	Necessary	script	fonts.gstatic.com
Google LLC Google tracker domain (source: Disconnect.me, category: Content)	Necessary	script	ajax.googleapis.com
HubSpot HubSpot tracker domain (source: Disconnect.me, category: Content)	Necessary	script	js-eu1.hsforms.net
Google LLC before consent Google tracker domain (source: Disconnect.me, category: FingerprintingGeneral)	Unknown	script	region1.google-analytics.com
Google LLC before consent Google tracker domain (source: Disconnect.me, category: FingerprintingGeneral)	Unknown	script	pagead2.googlesyndication.com
UserCentrics UserCentrics tracker domain (source: Disconnect.me, category: ConsentManagers)	Unknown	script	consentcdn.cookiebot.com