What does ulta.com track?
Before any consent, ulta.com loaded 26 tracking companies and set 25 advertising or analytics cookies.
That's more tracking companies than 99% of the 2,450 sites we scanned.
Scanned October 2, 2026 from Germany, loading www.ulta.com once and clicking nothing. How we scan
- Tracking companies
- 26
- Tracking cookies
- 25
- Third-party hosts
- 93
- Cookies in total
- 61
Consent banner
The page loaded OneTrust, a consent management platform. Everything below was recorded before anyone answered it. 26 tracking companies still loaded while it was unanswered.
Companies contacted before consent
18 of the 51 companies it contacted before consent were unclassified.
- Google Ads49 requestsAdvertising
14666520.fls.doubleclick.net, 4728858.fls.doubleclick.net, ad.doubleclick.net, 9596862.fls.doubleclick.net
- LiveRamp9 requestsAdvertising
live.rezync.com, idsync.rlcdn.com, di.rlcdn.com
- The Trade Desk6 requestsAdvertising
insight.adsrvr.org, js.adsrvr.org, match.adsrvr.org
- Criteo3 requestsAdvertising
dynamic.criteo.com, d.criteo.com, gum.criteo.com
- Zeta Global3 requestsAdvertising
cdn.boomtrain.com, people.api.zetaglobal.net
- Xandr (Microsoft)2 requestsAdvertising
ib.adnxs.com
- PubMatic2 requestsAdvertising
image2.pubmatic.com
- OpenX2 requestsAdvertising
us-u.openx.net
- Media.net2 requestsAdvertising
contextual.media.net
- LiveIntent2 requestsAdvertising
i.liadm.com
- Index Exchange2 requestsAdvertising
dsum-sec.casalemedia.com
- Magnite2 requestsAdvertising
partners.tremorhub.com
- TransUnion (Aggregate Knowledge)2 requestsAdvertising
aa.agkn.com
- BidSwitch2 requestsAdvertising
x.bidswitch.net
- Microsoft Advertising1 requestAdvertising
bat.bing.com
- Pinterest7 requestsSocial media
ct.pinterest.com, s.pinimg.com
- TikTok6 requestsSocial media
analytics.tiktok.com, analytics-ipv6.tiktokw.us
- Snap4 requestsSocial media
tr.snapchat.com, sc-static.net
- Reddit3 requestsSocial media
www.redditstatic.com, pixel-config.reddit.com, alb.reddit.com
- Meta2 requestsSocial media
connect.facebook.net
- Tealium14 requestsAnalytics
tags.tiqcdn.com
- Adobe11 requestsAnalytics
dpm.demdex.net, sync-tm.everesttech.net, cdn1.adoberesources.net, ulta-1.demdex.net
- Dynatrace7 requestsAnalytics
bf78180lnp.bf.dynatrace.com
- Google Analytics4 requestsAnalytics
www.googletagmanager.com, region1.analytics.google.com
- Quantum Metric2 requestsAnalytics
cdn.quantummetric.com, ingest.quantummetric.com
- Medallia1 requestAnalytics
analytics-fe.digital-cloud-us-main.medallia.com
Other third parties (content delivery, consent, functional, unclassified)
- ultainc.com60 requestsUnclassified
media.ultainc.com
- sierra.chat12 requestsUnclassified
sierra.chat
- rfihub.com4 requestsUnclassified
p.rfihub.com, 20870592p.rfihub.com, 20870594p.rfihub.com
- kampyle.com3 requestsUnclassified
nebula-cdn.kampyle.com
- openai.com3 requestsUnclassified
bzrcdn.openai.com, bzr.openai.com
- channeladvisor.com2 requestsUnclassified
t.channeladvisor.com, tracking2.channeladvisor.com
- tvpage.com2 requestsUnclassified
a.tvpage.com, api.tvpage.com
- clrt.ai2 requestsUnclassified
js.clrt.ai, 13578.clrt.ai
- ru4.com2 requestsUnclassified
d.xp1.ru4.com
- rqtrk.eu2 requestsUnclassified
wt.rqtrk.eu
- impactradius-event.com1 requestUnclassified
d.impactradius-event.com
- adn.cloud1 requestUnclassified
tags.pw.adn.cloud
- narrativ.com1 requestUnclassified
static.narrativ.com
- adeptmind.ai1 requestUnclassified
raven.ulta.adeptmind.ai
- adxcel-ec2.com1 requestUnclassified
data.adxcel-ec2.com
- ztk5.net1 requestUnclassified
ulta.ztk5.net
- ojrq.net1 requestUnclassified
www.ojrq.net
- rfihub.net1 requestUnclassified
c1.rfihub.net
- OneTrust12 requestsConsent banner
cdn.cookielaw.org, geolocation.onetrust.com
- Sourcepoint3 requestsConsent banner
launchpad-wrapper.privacymanager.io, launchpad.privacymanager.io, geo.privacymanager.io
- Google24 requestsFunctional
www.google.com, adservice.google.com, www.gstatic.com, agents.cloud.google.com
- Gladly6 requestsFunctional
cdn.gladly.com
- Google Cloud10 requestsContent delivery
deliveryapi-tx4-27161589503.us-central1.run.app
- Akamai2 requestsContent delivery
s.go-mpulse.net, c.go-mpulse.net
- Cloudflare1 requestContent delivery
cdnjs.cloudflare.com
Cookies set before consent
The longest-lived tracking cookie it set was AMCV_C218F16F55CC57607F000101%40AdobeOrg, from Adobe, lasting about 13 months.
| Cookie | Purpose | Set by | Lasts |
|---|---|---|---|
| _gcl_au | Advertising | ulta.com | 3 months |
| _rdt_uuid | Advertising | ulta.com | 3 months |
| _scid | Advertising | ulta.com | 13 months |
| _scid_r | Advertising | ulta.com | 13 months |
| _ttp | Advertising | tiktok.com (third party) | 13 months |
| AMCV_C218F16F55CC57607F000101%40AdobeOrg | Advertising | ulta.com | 13 months |
| AMCVS_C218F16F55CC57607F000101%40AdobeOrg | Advertising | ulta.com | Session |
| brwsr | Advertising | ztk5.net (third party) | 12 months |
| brwsr | Advertising | ojrq.net (third party) | 12 months |
| demdex | Advertising | demdex.net (third party) | 6 months |
| dpm | Advertising | dpm.demdex.net (third party) | 6 months |
| everest_g_v2 | Advertising | everesttech.net (third party) | 12 months |
| IDE | Advertising | doubleclick.net (third party) | 13 months |
| IR_gbd | Advertising | ulta.com | Session |
| IR_PI | Advertising | ulta.com | 12 months |
| irtps | Advertising | ztk5.net (third party) | 1 day |
| MUID | Advertising | bing.com (third party) | 13 months |
| s_ecid | Advertising | ulta.com | 13 months |
| sd-session-id | Advertising | live.rezync.com (third party) | 6 months |
| zync-uuid | Advertising | rezync.com (third party) | 6 months |
| dtCookie | Analytics | ulta.com | Session |
| dtPC | Analytics | ulta.com | Session |
| dtSa | Analytics | ulta.com | Session |
| rxVisitor | Analytics | ulta.com | 13 months |
| rxvt | Analytics | ulta.com | Session |
| __obref | Unclassified | ulta.com | 12 months |
| __ruid | Unclassified | ulta.com | 6 months |
| __ruid | Unclassified | www.ulta.com | 6 months |
| _caid | Unclassified | ulta.com | 30 days |
| _cavisit | Unclassified | ulta.com | Under a day |
| _mibhv | Unclassified | www.ulta.com | 12 months |
| akaalb_alb_services_apigee_com | Unclassified | www.ulta.com | Session |
| akaalb_alb_www_dsp | Unclassified | ulta.com | Session |
| akaalb_alb_www_dsp | Unclassified | www.ulta.com | Session |
| akaalb_Instance-1 | Unclassified | rkt.ulta.com | Session |
| gpv | Unclassified | ulta.com | Under a day |
| IR_3037 | Unclassified | ulta.com | Session |
| irld | Unclassified | ulta.ztk5.net (third party) | 6 months |
| ULTA_DSP_AT | Unclassified | www.ulta.com | Session |
| ULTA_DSP_RT | Unclassified | www.ulta.com | 30 days |
| ULTA_SITE | Unclassified | www.ulta.com | Session |
| ULTASITE | Unclassified | www.ulta.com | Session |
| user_attributes | Unclassified | www.ulta.com | 1 day |
| User-Agent | Unclassified | www.ulta.com | Session |
| utag_ck_gtid | Unclassified | ulta.com | Session |
| X_ULTA_SITE | Unclassified | www.ulta.com | Session |
| X_ULTA_VISITOR_ID | Unclassified | ulta.com | 6 months |
| X_ULTA_VISITOR_ID | Unclassified | www.ulta.com | 6 months |
| __cf_bm | Functional | bzrcdn.openai.com (third party) | Under a day |
| _cfuvid | Functional | bzrcdn.openai.com (third party) | Session |
| AKA_A2 | Functional | ulta.com | Under a day |
| AWSALBCORS | Functional | ulta.ztk5.net (third party) | 7 days |
| kampyle_userid | Functional | www.ulta.com | 12 months |
| kampyleSessionPageCounter | Functional | www.ulta.com | 12 months |
| kampyleUserPercentile | Functional | www.ulta.com | 12 months |
| kampyleUserSession | Functional | www.ulta.com | 12 months |
| kampyleUserSessionsCount | Functional | www.ulta.com | 12 months |
| OptanonConsent | Functional | www.ulta.com | 12 months |
| RT | Functional | ulta.com | 7 days |
| utag_main | Functional | ulta.com | 12 months |
| X-AB | Functional | sc-static.net (third party) | 1 day |
The page also wrote 25 keys to local storage, which works like a cookie but isn't sent with requests.
Understanding this page
- How to see which cookies and trackers a website loads
A hands-on walkthrough for checking what a site sets before you've clicked anything, using Chrome and Firefox's built-in tools, plus how CookieTosser automates the same check every month.
- What counts as valid cookie consent in the EU
The rules that actually govern cookie banners — the ePrivacy Directive, the GDPR consent standard, the Planet49 ruling, the strictly-necessary exemption, and what "reject" has to offer compared with "accept.
- Consent management platforms explained
What a CMP banner is actually doing behind the scenes, how the IAB's TCF standard and Google's Consent Mode v2 fit in, and why a banner being present is no guarantee that nothing loads before you answer it.