Does decrypt.co use cookies?

decrypt.co uses 10 cookies. The site uses Cookiebot as its consent management platform.

Does decrypt.co use a cookie banner (CMP)?

Yes. decrypt.co uses Cookiebot as its consent management platform. IAB TCF v2.3 consent signals were detected. Google Consent Mode v2 appears to be configured.

Which third-party trackers does decrypt.co use?

decrypt.co loads 22 third-party requests from 14 vendors, including ab.dns-finder.com, Chartbeat, Cloudflare Inc., Google LLC, spindl.link.

How many marketing and analytics cookies does decrypt.co set?

decrypt.co sets 1 marketing and 1 analytics cookies, alongside 3 strictly necessary cookies. Under GDPR and the ePrivacy Directive, non-essential cookies require prior consent.

decrypt.co

Item: decrypt.co
Rating: 24
Author: Passiro

https://decrypt.co

Last scanned September 1, 2026

A cookie scan of decrypt.co performed on September 1, 2026 found 10 cookies and 22 third-party tracking requests. The assessment covered 10 pages across 10 unique page templates. The site relies on Cookiebot as its consent management platform with IAB TCF v2.3 and Google Consent Mode v2. 22 third-party requests were detected from 14 vendors.

Claim & unlock

Third-party

Trackers

Vendors

Consent banner

Cookiebot

Scans

What this setup is missing

The published cookie declaration does not include all cookies observed on the site.

Compliance by audience

European Union

✗ Not met

GDPR + ePrivacy · Prior consent (opt-in)

United Kingdom

✗ Not met

UK GDPR + PECR · Consent-based

United States

✓ Meets this model

CCPA/CPRA + state laws · Notice & opt-out

Canada

! Needs attention

PIPEDA + Québec Law 25 · Consent-based

Brazil

! Needs attention

LGPD · Consent-based

Scanned from the EU; sites may serve different banners or tracking to other regions. Verdicts reflect observed behaviour measured against each audience's rules.

Connection security

HTTPS supported

✓

Redirects HTTP to HTTPS

✓

HSTS

✓

Content Security Policy

✗

Cookies

10 cookies detected: 3 necessary, 1 analytics, 1 marketing

Total

Necessary

Functional

Analytics

Marketing

Unknown

Filter by category

Name	Domain	Category	Provider	Expiry	Secure	HttpOnly	Party
_chartbeat2 before consent	.decrypt.co	Analytics	Chartbeat	1 yr	✓	–	1st
_cioanonid before consent	.decrypt.co	Marketing	Customer.io	344 d	–	–	1st
cf_clearance	.decrypt.co	Necessary	Cloudflare	344 d	✓	✓	1st
GDPR_Settings	decrypt.co	Necessary	Cookie Consent	1 yr	–	–	1st
__cf_bm	.decrypt.co	Necessary	Cloudflare	Expired	✓	✓	1st
spdl_pid before consent	.decrypt.co	Unknown	-	344 d	–	–	1st
_cb before consent	.decrypt.co	Unknown	-	1 yr	✓	–	1st
_cb_svref before consent	.decrypt.co	Unknown	-	Expired	✓	–	1st
_twpid before consent	.decrypt.co	Unknown	-	1 yr	✓	–	1st
_twsid before consent	.decrypt.co	Unknown	-	1 yr	✓	–	1st

Browser storage set by the site

Name	Domain	Party
spindl_session_id set by decrypt.co/_app-22d1feeb8f4685d6.js:1:600662	https://decrypt.co	1st	before consent
spindl_persistent_id set by decrypt.co/_app-22d1feeb8f4685d6.js:1:601580	https://decrypt.co	1st	before consent
spindl_request_id set by decrypt.co/_app-22d1feeb8f4685d6.js:1:603416	https://decrypt.co	1st	before consent
REACT_QUERY_OFFLINE_CACHE set by decrypt.co/_app-22d1feeb8f4685d6.js:73:321976	https://decrypt.co	1st	before consent
wagmi.cache set by decrypt.co/_app-22d1feeb8f4685d6.js:76:4428	https://decrypt.co	1st	before consent
BT_sid set by btloader.com/tag	https://decrypt.co	1st	before consent
_cb_ls_test set by static.chartbeat.com/chartbeat.js:38:500	https://decrypt.co	1st	before consent
_cb set by static.chartbeat.com/chartbeat.js:39:86	https://decrypt.co	1st	before consent
_cb_expires set by static.chartbeat.com/chartbeat.js:39:101	https://decrypt.co	1st	before consent
_chartbeat2 set by static.chartbeat.com/chartbeat.js:39:86	https://decrypt.co	1st	before consent
_chartbeat2_expires set by static.chartbeat.com/chartbeat.js:39:101	https://decrypt.co	1st	before consent
_cb_svref set by static.chartbeat.com/chartbeat.js:39:86	https://decrypt.co	1st	before consent
_cb_svref_expires set by static.chartbeat.com/chartbeat.js:39:101	https://decrypt.co	1st	before consent
BT_tpc set by btloader.com/tag	https://decrypt.co	1st	before consent
onesignal-pageview-count set by cdn.onesignal.com/OneSignalPageSDKES6.js	https://decrypt.co	1st	before consent
os_pageViews set by cdn.onesignal.com/OneSignalPageSDKES6.js	https://decrypt.co	1st	before consent
isOptedOut set by cdn.onesignal.com/OneSignalPageSDKES6.js	https://decrypt.co	1st	before consent
isPushNotificationsEnabled set by cdn.onesignal.com/OneSignalPageSDKES6.js	https://decrypt.co	1st	before consent
WCM_VERSION set by decrypt.co/65160.f78381d47e1cbbdb.js:1:6013	https://decrypt.co	1st	before consent
BT_AA_DETECTION set by btloader.com/tag	https://decrypt.co	1st	before consent
btUserCountry set by btloader.com/tag	https://decrypt.co	1st	before consent
btUserCountryExpiry set by btloader.com/tag	https://decrypt.co	1st	before consent
btUserIsFromRestrictedCountry set by btloader.com/tag	https://decrypt.co	1st	before consent
gist.web.isPersistingSession set by code.gist.build/gist.min.js:1:1207	https://decrypt.co	1st	before consent
gist.web.userQueueUseSSE set by code.gist.build/gist.min.js:1:1041	https://decrypt.co	1st	before consent

Third-Party Trackers

22 requests detected from 14 vendors: ab.dns-finder.com, Chartbeat, Cloudflare Inc., Google LLC, spindl.link...

Analytics

Marketing

Necessary

Functional

Other

Vendor	Category	Type	Domain
ab.dns-finder.com before consent	Analytics	fetch	ab.dns-finder.com
Chartbeat before consent Chartbeat tracker domain (source: Disconnect.me, category: Content)	Analytics	script	static.chartbeat.com
Chartbeat before consent Chartbeat tracker domain (source: Disconnect.me, category: Analytics)	Analytics	script	ping.chartbeat.net
Cloudflare Inc. before consent Cloudflare Web Analytics	Analytics	script	static.cloudflareinsights.com
Google LLC before consent Google Tag Manager	Analytics	script	www.googletagmanager.com
Google LLC before consent Google tracker domain (source: Disconnect.me, category: Analytics)	Analytics	script	www.googleoptimize.com
spindl.link before consent	Analytics	fetch	spindl.link
Adobe Fonts before consent Adobe Fonts (Typekit): web font delivery	Functional	script	p.typekit.net
AdDelivery before consent AdDelivery tracker domain (source: Disconnect.me, category: Advertising)	Marketing	script	ad-delivery.net
CustomerIO before consent CustomerIO tracker domain (source: Disconnect.me, category: EmailAggressive)	Marketing	script	assets.customer.io
eyeo before consent eyeo tracker domain (source: Disconnect.me, category: Advertising)	Marketing	script	btloader.com
OneSignal before consent OneSignal tracker domain (source: Disconnect.me, category: Advertising)	Marketing	script	cdn.onesignal.com
X (Twitter) before consent Twitter tracker domain (source: Disconnect.me, category: Advertising)	Marketing	pixel	static.ads-twitter.com
X (Twitter) before consent Twitter tracker domain (source: Disconnect.me, category: Advertising)	Marketing	script	t.co
X (Twitter) before consent Twitter tracker domain (source: Disconnect.me, category: Social)	Marketing	script	syndication.x.com
X Corp (Twitter) before consent X/Twitter platform widgets	Marketing	script	platform.twitter.com
Cybot A/S (Cookiebot) Cookiebot consent management	Necessary	script	consent.cookiebot.com
Google LLC Google Fonts stylesheet	Necessary	script	fonts.googleapis.com
X (Twitter) Twitter tracker domain (source: Disconnect.me, category: Content)	Necessary	script	cdn.syndication.twimg.com
Google LLC before consent Google tracker domain (source: Disconnect.me, category: FingerprintingGeneral)	Unknown	script	ad.doubleclick.net
Google LLC before consent Google tracker domain (source: Disconnect.me, category: FingerprintingGeneral)	Unknown	script	region1.google-analytics.com
UserCentrics UserCentrics tracker domain (source: Disconnect.me, category: ConsentManagers)	Unknown	script	consentcdn.cookiebot.com