Findings that a legal, compliance or security owner must approve before the fix ships. They affect what Grayscale tells visitors, what it collects from them and what it publishes about its funds.
Consent and tracking
Critical1High1
Who acts Legal sets the scope. Engineering changes the tag manager.
The ETF site keeps tracking visitors who decline cookies, and both main sites load ad tags before any choice.
A-1Criticaletfs
The ETF site keeps loading tracking tags after a visitor declines cookies
CONFIRMED, etfs. The Cookiebot banner (a cookie consent tool) records a decline (necessary: true, preferences: false, statistics: false, marketing: false). After a reload, the page still sends requests to google-analytics.com, Clarity, the Meta pixel, Reddit, X (Twitter) ads and HubSpot.
Evidence 3 runs on etfs.grayscale.com/gbtc and etfs.grayscale.com/, each with the same third-party domains after the decline. On www.grayscale.com the same test shows 0 tracking requests after a decline.
Impact Visitors who refuse tracking are still tracked. This is a consent and privacy risk for a regulated fund issuer.
Fix Fire every analytics and ad tag in the etfs tag manager container (the tool that loads tags) only on the matching Cookiebot consent category, as www already does after a decline.
A-11Highwwwetfs
Ad tags fire before a visitor makes a cookie choice, and the first layer (the first banner screen) has no visible Deny button
CONFIRMED, www and etfs. The first banner layer shows "Allow all" and "Customize". A "Deny" button exists in the page but is hidden.
Evidence Before any choice, www loads the tag manager, Floodlight (Google ad tracking, src=14901210) and a Google Ads conversion, and sets _gcl_au and IDE. etfs loads the tag manager, Clarity, HubSpot, the Meta pixel, Bing, Floodlight, Reddit and X, and sets _fbp, _clck and __hstc.
Impact Tracking starts before consent. Legal review decides what the banner must do for US visitors (Cookiebot reports no GDPR (EU privacy law) or CCPA (California privacy law) rule for the test visitor).
Fix Block ad and analytics tags until a choice, and show Deny on the first layer.
// The exact change
H.1 Consent gating (tags load only after consent) on etfs (A-1, A-11)
In the etfs tag manager container, set each analytics and ad tag (Google Analytics 4 [GA4], Clarity, Meta, Reddit, X, HubSpot, LinkedIn, Bing, Floodlight, Google Ads) to load only when Cookiebot reports consent for its category: statistics for analytics, marketing for ads.
Turn on Google Consent Mode with ad_storage, analytics_storage, ad_user_data and ad_personalization set to denied by default, on www and on etfs.
Show the Deny button on the first banner layer.
Test: decline, reload, and record network requests on etfs.grayscale.com/gbtc, in 3 of 3 runs. Expected result: no request to google-analytics.com, clarity.ms, connect.facebook.net, reddit.com, ads-twitter.com or hubspot.com, or to the LinkedIn, Bing, Floodlight and Google Ads tag hosts, and no _fbp, _clck, __hstc, _gcl_au or IDE cookie is set. In advanced Consent Mode, Google tags still send requests without cookies after a decline; legal decides whether basic mode (no Google request at all) is required.
The Institute site: privacy text, test markers and publisher identity
Critical1High3Low1
Who acts Legal and security review first. Then the Institute editor and engineering remove the text.
The Institute site carries a privacy line that says personal data is sold, text that matches security test markers, live placeholders, and markup that names another company as publisher.
C-1CriticalInstitute
The Institute privacy policy says personal data is sold to sponsors
CONFIRMED, institute.grayscale.com/privacy/. The page reads: "We sell personal identification information to our sponsors."
Impact A public statement that a fund issuer's education site sells personal data. Grayscale's main privacy policy (www, last update 06/06/2025) describes the right to know about sales of personal information and the right to opt out of future sales. It does not say that data is sold to sponsors.
Fix Legal reviews the Institute policy and replaces it with Grayscale's own privacy policy text.
A-3HighInstitute
The Institute site shows text that matches security test markers
CONFIRMED, Institute. Text such as GSSPWN286794A_ssrfTITLE, GSSPWN281766MARKERTITLE and GSSPWN281766CONTENTMARKER appear on Institute pages: the 2 title markers on the home page and on /the-stack/, the content marker on /the-stack/.
Evidence The Stack tag sitemap lists /the-stack/tag/gsspwn/ and /the-stack/tag/gsspwn286794/ (both 404). Institute links to /the-stack/gsspwn286794a_ssrftitle/ and /the-stack/gsspwn281766markertitle/, which 301 (permanent redirect) to www URLs that return 404.
Impact The names match test inputs for request forgery, a type of attack. The marker text is live on public Institute pages.
Fix The security team reviews how the test entries were created, then removes them, their tags and the sitemap rows.
C-2HighInstituteresearch
Template placeholders, error text and test pages are live
CONFIRMED, Institute and research.
"Essentials go here!" on /in-practice-how-to-integrate-digital-assets-into-traditional-portfolios/.
"Content goes here!" on /understanding-crypto-sectors-smart-contract-platforms/.
"Invalid Class ID provided" is the only content of /course-summary/.
/the-stack-subscription-test/ is an indexable form test page.
Research: "net inflows of $XXbn in September" (/market-commentary/september-2025-cycles-dont-die-of-old-age) and "growing to XX in 2024 year-to-date volume" (/reports/polymarket).
Fix Remove the placeholder pages or fill them, and replace the XX values with the real figures.
A-26HighInstitute
The Institute structured data names another company as the publisher
CONFIRMED, Institute. On all 64 Institute pages with saved HTML that answer 200 without a redirect, the Organization markup gives the name "Calamos Webcast Series", with sameAs links to https://x.com/calamos and the Calamos Investments LinkedIn page. The Article markup points its publisher at this Organization. The logo url and contentUrl are empty.
Impact The markup tells search engines and AI tools that a Calamos entity publishes the Institute site. That can weaken Grayscale's entity signals (how search engines identify an organization) and misattribute Institute content.
Fix Set the site's organization name, logo and social profiles in the SEO plugin to Grayscale's own, and add a sameAs link from the site markup to the Grayscale Investments Wikidata entry (Q114877232, official website grayscale.com).
A-22LowInstitute
The Institute robots.txt is a published draft
CONFIRMED. It contains notes such as "GEO-updated draft" and "let me know the path and I'll add an explicit Disallow", and a broken character encoding (an em dash shows as the 3 characters "—"). It blocks *.pdf for most named crawlers, including the AI search crawlers OAI-SearchBot, Claude-SearchBot and PerplexityBot, but not ChatGPT-User or Claude-User. The /?smd_process_download block sits only in the general group (the rules for all other crawlers), so the named crawler groups do not inherit it.
Fix Publish a clean file and decide whether course PDFs should be crawlable.
Fund pages and disclosures
High3
Who acts Compliance approves each change before it ships.
Fund pages name the wrong asset, older posts still call approved ETFs pending, and a webinar marked confidential is public. The page verdicts (Part G.1) also list a live copy of the Ethereum report without its disclosure section.
C-3Highwwwetfs
Fund pages and fund documents name the wrong asset
CONFIRMED. Three trust pages (www /funds/grayscale-walrus-trust, /funds/grayscale-basic-attention-token-trust and /funds/grayscale-deepbook-trust) say "Grayscale currently serves as a key maintainer for any Product’s TAO holdings." TAO is the Bittensor token, not the asset of any of the three trusts. The GAVA (Avalanche) document page (etfs /documents/gava) says "Because the value of the Fund is correlated with the value of Solana".
Impact Factual errors on regulated product pages.
Fix Correct the asset names; check every trust page and document page built from the same text block.
C-4Highwwwresearch
27 blog and research pages still describe spot ETF approval or the GBTC conversion as pending
(CONFIRMED; the 27 pages and their quotes are in pending-etf-pages.csv.) Examples: "Because there is not yet a Bitcoin ETF approval" (/blog/general-updates/whats-a-sec-reporting-company-six-things-to-know), "we are still waiting for U.S. regulators to approve a physically-backed or “spot” version" (/blog/general-updates/qa-what-converting-gbtc-to-an-etf-would-mean), "Our products are not ETFs but they do have a familiar structure to investors" (/blog/general-updates/a-milestone-for-grayscale-ethereum-trust). GBTC began trading on NYSE Arca as an ETF on January 11, 2024.
Impact Google asks "Does the content have any easily-verified factual errors?" (G-4).
Fix Add a dated note at the top of each page that states the current status and links to the fund page. No body rewrite is needed.
C-5Highresearch
A webinar that says it is confidential is public
(CONFIRMED, research /videos-and-webinars/grayscales-deeper-dive-into-basic-attention-token.) The transcript says "this webinar is for our existing private placement investors" and "It's confidential and closed to the public".
Fix Compliance confirms whether the page may be public; if not, remove it and redirect the URL.
Security headers and email
Low2
Who acts Security and engineering.
Small changes that close common gaps on the Vercel hosts and on the ZCSH domain.
A-23LowwwwetfsresearchZCSH
Vercel hosts send few security headers
CONFIRMED. www, etfs, research and the ZCSH site send HSTS (forces browsers to use HTTPS) and a CSP (content security policy) with only frame-ancestors, but no X-Content-Type-Options, Referrer-Policy or Permissions-Policy. The pages also send x-powered-by: Next.js.
Fix Add the three headers in the hosting settings.
A-25LowZCSH
The ZCSH domain does not enforce email authentication
CONFIRMED. thezcashetf.com publishes a DMARC email policy (email rule for failed checks) of p=none (monitoring only) and no DKIM (email signature) signing key at common selectors. grayscale.com uses p=reject.
Fix Move thezcashetf.com to p=quarantine, then p=reject, once every system that sends its email is listed.