What does iherb.com track?
Before any consent, iherb.com loaded 3 tracking companies and set 3 advertising or analytics cookies.
That's more tracking companies than 58% of the 2,450 sites we scanned.
Scanned October 2, 2026 from Germany, loading de.iherb.com once and clicking nothing. How we scan
- Tracking companies
- 3
- Tracking cookies
- 3
- Third-party hosts
- 16
- Cookies in total
- 29
Consent banner
The page loaded TrustArc, a consent management platform. Everything below was recorded before anyone answered it. 3 tracking companies still loaded while it was unanswered.
Companies contacted before consent
3 of the 9 companies it contacted before consent were functional companies.
- YouTube2 requestsSocial media
www.youtube.com
- New Relic5 requestsAnalytics
bam.nr-data.net, js-agent.newrelic.com
- Google Analytics2 requestsAnalytics
www.googletagmanager.com
Other third parties (content delivery, consent, functional, unclassified)
- images-iherb.com129 requestsUnclassified
cloudinary.images-iherb.com, s3.images-iherb.com
- iherbtest.com1 requestUnclassified
service-logger.app.iherbtest.com
- TrustArc4 requestsConsent banner
consent.trustarc.com
- Google9 requestsFunctional
www.gstatic.com, www.recaptcha.net, fonts.gstatic.com
- HUMAN Security (PerimeterX)7 requestsFunctional
collector-pxvtidnbtc.px-cloud.net, ift.px-cloud.net, js.px-cloud.net, ri.px-cloud.net
- Braze1 requestFunctional
js.appboycdn.com
Cookies set before consent
The longest-lived tracking cookie it set was __Secure-ROLLOUT_TOKEN, from YouTube, lasting about 6 months.
| Cookie | Purpose | Set by | Lasts |
|---|---|---|---|
| __Secure-ROLLOUT_TOKEN | Advertising | youtube.com (third party) | 6 months |
| VISITOR_INFO1_LIVE | Advertising | youtube.com (third party) | 6 months |
| VISITOR_PRIVACY_METADATA | Advertising | youtube.com (third party) | 6 months |
| dscid | Unclassified | iherb.com | 13 months |
| ForceTrafficSplitType | Unclassified | de.iherb.com | 14 days |
| ForceTrafficSplitType | Unclassified | iherb.com | 14 days |
| ih-exp-user-id | Unclassified | iherb.com | 6 months |
| ih-experiment | Unclassified | iherb.com | 12 months |
| ih-hp-vp | Unclassified | iherb.com | 13 months |
| ih-preference | Unclassified | iherb.com | 12 months |
| ih-pv-pr | Unclassified | iherb.com | 12 months |
| iher-pref1 | Unclassified | iherb.com | 12 months |
| ihr-temse | Unclassified | iherb.com | Under a day |
| srid | Unclassified | iherb.com | Under a day |
| srv_node | Unclassified | catalog.app.iherb.com | Session |
| srv_node | Unclassified | graphql-catalog.app.iherb.com | Session |
| srv_node | Unclassified | de.iherb.com | Session |
| srv_node | Unclassified | checkout1.iherb.com | Session |
| transactionIds | Unclassified | de.iherb.com | 13 months |
| __cf_bm | Functional | images-iherb.com (third party) | Under a day |
| __cf_bm | Functional | iherb.com | Under a day |
| __Secure-YNID | Functional | youtube.com (third party) | 6 months |
| cf_clearance | Functional | iherb.com | 12 months |
| YSC | Functional | youtube.com (third party) | Session |
| _px3 | Necessary | iherb.com | Under a day |
| _pxvid | Necessary | iherb.com | 12 months |
| notice_behavior | Necessary | iherb.com | Session |
| pxcts | Necessary | iherb.com | Session |
| TAsessionID | Necessary | iherb.com | Under a day |
The page also wrote 4 keys to local storage, which works like a cookie but isn't sent with requests.
Understanding this page
- How to see which cookies and trackers a website loads
A hands-on walkthrough for checking what a site sets before you've clicked anything, using Chrome and Firefox's built-in tools, plus how CookieTosser automates the same check every month.
- What counts as valid cookie consent in the EU
The rules that actually govern cookie banners — the ePrivacy Directive, the GDPR consent standard, the Planet49 ruling, the strictly-necessary exemption, and what "reject" has to offer compared with "accept.
- Consent management platforms explained
What a CMP banner is actually doing behind the scenes, how the IAB's TCF standard and Google's Consent Mode v2 fit in, and why a banner being present is no guarantee that nothing loads before you answer it.