use cases

An Order Confirmation Page Sent the Customer's Email to Meta, Google and Pinterest Before the Cookie Banner Was Answered

Say a small outdoor-gear shop runs a OneTrust cookie banner, Google Analytics, the Meta Pixel on every page, and the Pinterest Tag on its order confirmation page. The banner looks right. It appears on the first visit, has “Reject All” and “Accept All Cookies” buttons, and remembers the answer. The marketing team believes the pixels wait for it.

PXTA’s sample report for exactly this shop, Harbor & Pine Outfitters (a made-up business on PXTA’s test fixtures), shows they don’t. Every tag is pasted straight into the page template, so it runs before the banner script has drawn anything, and runs just the same after a visitor clicks “Reject All”.

The first findings of the Harbor and Pine Outfitters sample report: high-severity findings where Google Analytics 4, the Meta Pixel and the Pinterest Tag each sent the customer’s email address from the order confirmation page before the banner was answered.

The Address Is the Leak

The confirmation page lives at an address like /checkout/confirm?order=10442&[email protected]. The shop’s checkout puts the email in the query string so the page can greet the customer by name and show where the receipt went. Nobody thought of the address as data.

Every pixel on the page sends the page’s address, because that’s what pixels do. So the email went out three times: to Google Analytics and the Meta Pixel in the page address field (dl), and to the Pinterest Tag inside its own page address field. PXTA writes each one as a sentence, the way it appears in the report:

On /checkout/confirm?order=10442&[email protected], the Meta Pixel sent an email address inside the page address before the consent banner was answered.

On the same page the Meta Pixel was set up with advanced matching, and the Pinterest Tag with its own version of it. Both hashed [email protected] with SHA-256 and sent the hash. PXTA saw the address on the page, hashed it the same way, found the match, and said so: the Meta Pixel sent a SHA-256 hash of the email address [email protected].

The shop did set Google’s Consent Mode to “denied” by default. So Google Analytics reported gcs=G100, denied for ads and analytics, and still sent the page address with the email in it. PXTA flags that as its own finding, consent-mode-mismatch. Consent Mode changes what Google stores. It doesn’t stop the tag from sending what the site hands it.

What Fixing It Looks Like

There are two separate fixes, and the report points at both:

  • Take the email out of the address. The confirmation page can look the order up by its number and a session, so no tag ever sees the address. This fixes the leak for every tracker at once, including ones added next year.
  • Make the tags wait for the banner. The consent behaviour table in the report lists each tracker as “fires before an answer” or “ignores reject”. The Tidewater Bakery sample report shows what the same table looks like when it’s right: quiet, quiet, sends.

Rerunning pxta audit on the confirmation page alone takes under a minute, and every finding carries the command for it:

pxta audit 'https://www.harborpine.test/checkout/confirm?order=10442&[email protected]' --pages 1