pxta.com

A Clinic's Condition Pages Went to TikTok and LinkedIn While Google Analytics Waited for Consent

Sun, 25 Oct 2026 00:00:00 +0000

Cedar Valley Clinic is a made-up family practice on PXTA’s test fixtures, and its sample report is a common story. The web team set up a Cookiebot banner and wired Google Analytics to it properly: the analytics tag loads only after a visitor accepts. Later the marketing team ran a campaign on TikTok and LinkedIn and pasted both pixels into the site template. Nobody connected them to the banner.

So half the site’s tracking behaves and half doesn’t, and an audit that only checked “is there a banner?” would pass it.

A Hashed Email Address Still Identifies Someone, Here Is How Ad Networks Match It

Sun, 25 Oct 2026 00:00:00 +0000

Almost every ad network now offers a way to send customer details from a website “securely hashed”. Meta calls it advanced matching, Google calls it enhanced conversions, Pinterest calls it enhanced match. The tag runs the visitor’s email through SHA-256 and sends a 64-character string instead of the address.

That sounds like anonymisation. It isn’t, and the networks don’t claim it is. The whole point of the feature is to find the person.

A Lender's Reject Button Loaded the Ad Tags Anyway, and Google Consent Mode Reported Granted

Sun, 25 Oct 2026 00:00:00 +0000

Marlow Home Loans, another made-up business from PXTA’s test fixtures, did more than most sites. Its tags really do wait for the cookie banner, a Usercentrics one. Before a visitor answers, PXTA’s first pass saw nothing from Microsoft’s UET tag or the X Pixel. On a quick manual check the site looks careful.

The bug is in the second pass. The site’s code loads its tags when the visitor answers the banner, any answer. “Deny” counts as an answer, so a visitor who rejects tracking gets the full set.

A Newsletter Form Sent the Hash of an Email Nobody Submitted, Through the Meta Pixel's Automatic Matching

Sun, 25 Oct 2026 00:00:00 +0000

Some pixels don’t wait for a site to hand them an email address. They read it off the page. Meta’s automatic advanced matching watches form fields, and when a visitor types into one that looks like an email field, the pixel hashes what it finds and sends it with its next event. The visitor hasn’t pressed “Sign up”. They might never press it.

This is hard to see from the site’s side. Nothing in the site’s own code mentions the email field. The behaviour comes with the pixel, switched on with a checkbox in an ads dashboard.

A Quarterly Tracking Sweep for Privacy and Legal Teams, With Evidence Kept on File

Sun, 25 Oct 2026 00:00:00 +0000

A privacy team usually learns what the website sends from the marketing team’s description of it. That description is honest and almost always incomplete, because tags change faster than anyone writes them down. A sweep every quarter, run by the privacy team itself, gives it its own record.

PXTA suits this because its output is built to be filed. One folder per site per quarter, each with a report a lawyer can read and a raw capture with a checksum.

A Tracking Audit for Agency Handovers, Before You Take Over a Client's Tags

Sun, 25 Oct 2026 00:00:00 +0000

When an agency takes over a client’s site, it inherits every tag the last three agencies installed. Nobody hands over a list, because nobody has one. The first time anyone finds out about the old TikTok pixel is when it shows up in a complaint.

A PXTA audit on day one gives the new agency that list, with dates, and a record of the state it inherited.

An Order Confirmation Page Sent the Customer's Email to Meta, Google and Pinterest Before the Cookie Banner Was Answered

Sun, 25 Oct 2026 00:00:00 +0000

Say a small outdoor-gear shop runs a OneTrust cookie banner, Google Analytics, the Meta Pixel on every page, and the Pinterest Tag on its order confirmation page. The banner looks right. It appears on the first visit, has “Reject All” and “Accept All Cookies” buttons, and remembers the answer. The marketing team believes the pixels wait for it.

PXTA’s sample report for exactly this shop, Harbor & Pine Outfitters (a made-up business on PXTA’s test fixtures), shows they don’t. Every tag is pasted straight into the page template, so it runs before the banner script has drawn anything, and runs just the same after a visitor clicks “Reject All”.

Checking a Cookie Banner Migration With Two PXTA Audits, One Before the Switch and One After

Sun, 25 Oct 2026 00:00:00 +0000

Agencies move clients between consent platforms all the time: OneTrust to Cookiebot, a home-made banner to Didomi, one Usercentrics version to the next. The new banner gets tested by clicking it. The tags behind it usually don’t, because nobody has a list of what the old setup was doing in the first place.

Two PXTA audits make that list and check it.

Checking a Staging Build for Tracking Problems Before It Reaches Production

Sun, 25 Oct 2026 00:00:00 +0000

Developers rarely add tracking pixels. They add the things that make pixels leak: a confirmation page that puts the email in the URL, a new search page, a redesigned form, a template change that moves the tag snippet above the banner script. The tags were fine yesterday and the page around them changed.

Running PXTA against a staging build before release catches those changes while the branch is still open.

Checking Tracking Before a Campaign Goes Live, a Ten-Minute Routine for Marketers

Sun, 25 Oct 2026 00:00:00 +0000

New campaigns bring new tags. A landing page gets a conversion pixel, the thank-you page gets another, and someone adds the new ad network’s base code to the template “just to be safe”. The campaign launches on Monday and nobody looks at what the tags send until something goes wrong.

Ten minutes with PXTA before launch catches the common mistakes while they’re still cheap.

Google Consent Mode gcs Values Explained, What G100, G110, G101 and G111 Mean in a Request

Sun, 25 Oct 2026 00:00:00 +0000

Google Consent Mode is how a cookie banner tells Google’s tags what the visitor agreed to. The site sets defaults when the page loads, usually “denied”, and updates them when the visitor answers. Google’s tags then add the current state to every request they send, in a short field called gcs.

Four characters, and most people never look at them. They’re worth reading, because they show what the tags were told at the moment each request left the browser.

Google Tag Manager Sends Almost Nothing Itself, but It Decides What Everything Else Sends

Sun, 25 Oct 2026 00:00:00 +0000

Google Tag Manager is a loader. The site puts one snippet on every page, the snippet fetches a container from www.googletagmanager.com/gtm.js?id=GTM-..., and the container loads every other tag the marketing team has set up in Tag Manager’s web interface. The request PXTA sees from Tag Manager itself carries little more than the container ID.

So why list it at all? Because when a report shows a Meta Pixel or a TikTok tag firing at the wrong moment, the fix very often lives inside a Tag Manager container.

Handing Pixel Evidence to Counsel, a Report, a HAR File and the Checksum That Ties Them Together

Sun, 25 Oct 2026 00:00:00 +0000

Say a company’s general counsel gets a letter claiming its website shared visitors’ data with an ad network without consent. The first question is simple and nobody inside can answer it from memory: what does the site actually send, today, and when? Screenshots of a browser’s network panel are hard to read, easy to dispute and impossible to repeat.

PXTA’s output is built for this hand-off. One audit produces three files that belong together.

How PXTA Was Tested, From Fourteen Banner Setups to a 500-Page Crawl With the Browser Killed Halfway

Sun, 25 Oct 2026 00:00:00 +0000

A tool that says “this tag fired before consent” has to be right, or its reports are worse than nothing. So PXTA’s tests run real Chrome against real pages, and the results of the release run are kept in the code repository, next to the code they tested. Every number on this site comes from those files.

The run behind version 0.1 used Chrome for Testing 153 on Linux, with Go 1.24.7. All 70 tests and subtests passed. One was skipped by design: the sample report gallery, which the same script runs on its own afterwards.

How Site Search Terms Leak to Ad Trackers Through the Page Address

Sun, 25 Oct 2026 00:00:00 +0000

A site’s own search box is where visitors type what they actually want. On a pharmacy it’s a medicine. On a lender it’s “bankruptcy”. On a clinic it’s a symptom. Nobody types those into a page title, but they type them into search.

Most sites put the search in the page address: /search?q=pregnancy+test. And nearly every tracker sends the page address with every event. Put the two together and the search goes to every ad network on the page.

PXTA Means Pixel Tracking Audit, Named After the One-Pixel Image That Started Web Tracking

Sun, 25 Oct 2026 00:00:00 +0000

PXTA is short for Pixel Tracking Audit. Take the P and the X from pixel, the T from tracking, the A from audit. Say it letter by letter, or “pix-ta” if you prefer. Both work, and the site lives at pxta.com either way.

The X needs explaining, and so does the pixel. “px” has stood for pixel for decades: it’s the unit in every CSS width and every image editor’s ruler, so a developer reads PX and thinks of screens. The pixel part needs a little history, because a tracking pixel was once literally one pixel.

The First PXTA Release Is Out, a Free Command-Line Audit of What Tracking Pixels Send and When

Sun, 25 Oct 2026 00:00:00 +0000

The first PXTA release, version 0.1, is out. It’s a free, open-source command that loads a website in a real browser and writes down what every tracking pixel sends, where it goes, and whether the visitor had answered the cookie banner at the time.

You give it an address. It visits up to 20 pages, three times each if there’s a banner: once with the banner left alone, once after rejecting, once after accepting. Then it writes one HTML report, a JSON file of the findings and the raw capture as a HAR file.

Tracking Requests From Iframes and Web Workers, the Ones a Page Source Check Never Finds

Sun, 25 Oct 2026 00:00:00 +0000

The quickest way to see which trackers a site uses is to read its HTML and look for known scripts. Plenty of free tools do just that. It finds the Meta Pixel in the page template, and it misses everything that isn’t there.

Two places hide tracking from that kind of check: iframes and web workers.

What a Browser Tracking Audit Can't See, Server-Side Tagging and Conversion APIs

Sun, 25 Oct 2026 00:00:00 +0000

PXTA watches what leaves the browser. That covers most tracking on most websites, and it’s where the consent questions are sharpest, because it’s the visitor’s own device doing the sending. But it’s not everything, and a report that says nothing about the rest would be easy to misread.

So here’s the part a browser can’t see, stated plainly.

What a Correctly Set Up Cookie Banner Looks Like in a PXTA Report, From the Tidewater Bakery Sample

Sun, 25 Oct 2026 00:00:00 +0000

Most of PXTA’s sample reports show things going wrong, because that’s where the findings are. This one shows the target. Tidewater Bakery, a made-up bakery from PXTA’s test fixtures, runs a Didomi banner, Google Analytics and the Meta Pixel, and loads both tags only after a visitor accepts.

The report is short. That’s the point.

What a Tracking Pixel Sends Before You Click Accept, One Request at a Time

Sun, 25 Oct 2026 00:00:00 +0000

A tracking pixel is a small piece of code an advertising or analytics company gives a website. The site pastes it into its pages, and from then on every visitor’s browser reports to that company. Meta, Google, TikTok, LinkedIn, Microsoft, Pinterest, Snap and X all have one. A typical shop runs several.

What the pixel reports is decided by the pixel and by how the site set it up. The visitor never sees it. Here is what’s actually in one of those reports, and why it matters when it goes out before anyone clicks “Accept”.

What Google Analytics 4 Sends From a Website, and Where Personal Data Slips In

Sun, 25 Oct 2026 00:00:00 +0000

Google Analytics 4 sends its data to an address ending in /g/collect, on google-analytics.com, analytics.google.com or a regional variant of them. One request can hold several events, one per line of the request body, with page details in the query string.

Google’s own rules say not to send personally identifiable information to Analytics. That’s a rule for the site owner, though, and the tag sends whatever the page gives it. PXTA checks what actually goes out.

What the Google Ads Conversion Tag Sends, Including Enhanced Conversions

Sun, 25 Oct 2026 00:00:00 +0000

The Google Ads conversion tag tells Google that an ad click turned into a sale, a sign-up or a lead. It’s separate from Google Analytics, even when both are loaded by the same gtag.js script, and its requests go to different places: googleadservices.com/pagead/conversion/, googleads.g.doubleclick.net/pagead/viewthroughconversion/, and a few paths on www.google.com such as /pagead/1p-conversion/ and /ccm/collect.

PXTA knows all of those as one tracker, so a report lists “Google Ads conversion tag” once, whichever endpoint the site’s setup happens to use.

What the LinkedIn Insight Tag Sends, and Why Its Page Addresses Matter Most

Sun, 25 Oct 2026 00:00:00 +0000

The LinkedIn Insight Tag is a B2B favourite. It lets a company see which job titles and industries visit its site, retarget them on LinkedIn, and count conversions from LinkedIn ads. Requests go to px.ads.linkedin.com, mostly to /collect and /wa/.

Compared with the Meta and TikTok pixels it sends little. A partner ID, the page address, a timestamp. That’s exactly why the page address deserves attention: it’s nearly everything the tag says about the visit.

What the Meta Pixel Sends From a Website, Field by Field

Sun, 25 Oct 2026 00:00:00 +0000

The Meta Pixel is the most common ad tracker on small business websites. A shop installs it to see which Facebook and Instagram ads lead to sales, and to build audiences of people who visited. Each time it fires, the browser makes a request to facebook.com/tr, usually as a tiny image.

That request is short and easy to read once it’s decoded. PXTA’s catalog entry for the pixel knows what each field means, and the report shows them in a table under every finding.

What the Microsoft Advertising UET Tag Sends, Page Titles Included

Sun, 25 Oct 2026 00:00:00 +0000

Microsoft’s Universal Event Tracking tag, UET for short, is the conversion and remarketing tag for Microsoft Advertising, the ad network behind Bing search ads. It loads bat.js from bat.bing.com and sends its events to bat.bing.com/action/.

It gets less attention than the Meta Pixel, and it often sends more than people expect: its page load events usually carry the page address and the page title.

What the Pinterest Tag Sends, With Enhanced Match Hidden in a JSON Field

Sun, 25 Oct 2026 00:00:00 +0000

The Pinterest Tag sends its events to ct.pinterest.com/v3/ and /user/. Shops use it to count checkouts from Pinterest ads and to build audiences from site visitors, so it tends to sit on product, cart and confirmation pages.

Its requests pack data in an awkward way. Some fields are JSON objects squeezed into a single URL parameter: the page details in ad, customer details in pd. Read raw, they’re a wall of percent signs. PXTA unpacks the JSON and shows each part as its own row.

What the Snap Pixel Sends From a Website, Hashed Email Field Included

Sun, 25 Oct 2026 00:00:00 +0000

Snapchat’s pixel loads scevent.min.js from sc-static.net and posts its events to tr.snapchat.com, mostly /p. It’s common on shops that advertise to younger buyers, and like the other ad pixels it counts conversions and feeds audiences.

The request is a short form post. Four or five fields cover the event, the page, and, when it’s set up, the visitor’s hashed email.

What the TikTok Pixel Sends From a Website, Decoded From Its JSON Events

Sun, 25 Oct 2026 00:00:00 +0000

The TikTok Pixel doesn’t send a short query string like the older pixels. It posts a JSON document to analytics.tiktok.com/api/v2/pixel, with the event, the page and the visitor nested inside it. Reading one by hand means picking through braces. PXTA flattens the JSON into dotted field names, so context.page.url reads as one row in the report.

TikTok ads sell well for shops and service businesses alike, so the pixel turns up on sites that never had a social ad tag before, often pasted in by whoever ran the campaign.

What the X Pixel, Formerly the Twitter Pixel, Sends From Page Addresses to Search Terms

Sun, 25 Oct 2026 00:00:00 +0000

X’s website tag, still loaded from static.ads-twitter.com as uwt.js, sends its events to analytics.twitter.com/i/adsct and t.co/i/adsct. Many sites have one left over from a Twitter campaign years ago, and it keeps firing on every page.

Its request is a plain query string. The interesting field has a long name: tw_document_href, the address of the page.

What Websites Send When You Close the Page, and How PXTA Records Unload Beacons

Sun, 25 Oct 2026 00:00:00 +0000

A lot of tracking happens on the way out. Analytics tools want to know how long someone stayed and how far they scrolled, and the only moment they know that is when the visitor leaves. So scripts wait for the page to be hidden or closed, then send a last request with navigator.sendBeacon, which the browser delivers even as the page goes away.

These requests are easy to miss. Open the browser’s developer tools, click a link, and the network list clears for the new page, unless “Preserve log” was ticked first.

About

Mon, 01 Jan 0001 00:00:00 +0000

pxta.com is the home of PXTA, short for Pixel Tracking Audit. It’s a free command-line tool that crawls a website in a real browser and writes down what every tracking pixel sends, where it goes, and whether it went before the visitor answered the cookie banner. The report it produces is a list of findings, each one a plain sentence with the request that proves it.

The Name

PXTA is PiXel Tracking Audit. “px” has been shorthand for pixel for as long as screens have had them, from CSS widths to image editors, and a tracking pixel is where this whole kind of tracking started: a one-by-one image, invisible on the page, whose only job was to make the browser call home with some details attached. Today most “pixels” are scripts, but the name stuck, and marketing teams still talk about “installing the pixel”. So the tool that checks them borrows the old shorthand, then says what it does: tracking, audited. The post about the name has the longer story.

Contact

Mon, 01 Jan 0001 00:00:00 +0000

pxta.com would like to hear from:

Anyone who ran PXTA on a site. What it found, what it missed, and what you’d want in the report.
Anyone who found a bug. A banner it couldn’t answer, a tracker it didn’t recognise, a finding that’s wrong.
Privacy teams, lawyers and agencies with an audit PXTA nearly fits.

Write to info@pxta.com.

Bug reports are also welcome on GitHub. It helps to include what pxta version prints, your operating system and browser, and the findings.json of the audit. Please remove any personal data the audited site leaked before you send a report.

Download PXTA

Mon, 01 Jan 0001 00:00:00 +0000

The pxta command is one file with nothing else to install. It uses the Chrome, Chromium or Edge you already have. Each archive below holds it with its license files, and the links always point to the latest release.

System	Download
Linux, x86-64	pxta_linux_amd64.tar.gz
Linux, ARM64	pxta_linux_arm64.tar.gz
macOS, Apple silicon	pxta_darwin_arm64.tar.gz
macOS, Intel	pxta_darwin_amd64.tar.gz
Windows, x86-64	pxta_windows_amd64.zip

Checksums are in SHA256SUMS. Every release is listed on GitHub.

Install

On Linux or macOS:

Quick Start

Mon, 01 Jan 0001 00:00:00 +0000

PXTA audits the tracking on a website and writes a report you can read, file or send on. This page takes you from nothing to your first report in a few minutes.

1. Get PXTA and a Browser

Download the archive for your system from the download page, unpack it and put pxta somewhere on your PATH. PXTA drives a browser you already have: Google Chrome, Chromium or Microsoft Edge. Check it’s all there:

Reference

Mon, 01 Jan 0001 00:00:00 +0000

This page lists what PXTA looks for, how it rates what it finds, and every option. The same reference is in the README on GitHub.

The Three Passes

When a site shows a consent banner, PXTA loads every page three times, with a fresh browser profile for each pass:

Pass	What PXTA does first	A tracker sending data here means
Banner not answered	Nothing: the banner is left alone	it fired before consent
After reject	Rejects on the start page	it ignored the visitor’s “no”
After accept	Accepts on the start page	this is what the site sends with consent

With no banner, each page is loaded once, and the report says the site never asked.

Sample Reports

Mon, 01 Jan 0001 00:00:00 +0000

These are real PXTA reports, made by the release’s own tests against four made-up businesses. The sites, the banners and the tags are stand-ins built for testing PXTA, so nothing here describes a real company. Each one is the unedited report.html, with its findings.json and requests.har next to it in the test results on GitHub.

Site	Banner	What the report shows	Story
Harbor & Pine Outfitters, an outdoor-gear shop	OneTrust	Tags pasted into the template ignore the banner. The order confirmation page puts the customer’s email in its address, and three trackers send it.	The order confirmation page
Cedar Valley Clinic, a family practice	Cookiebot	Google Analytics waits for consent. TikTok and LinkedIn don’t, and get the condition pages and a search for “anxiety medication”.	The clinic’s condition pages
Marlow Home Loans, a lender	Usercentrics, in a closed shadow root	Tags wait for an answer, then load on “Deny” too. Consent Mode reports granted after the reject.	The lender’s reject button
Tidewater Bakery, a bakery	Didomi	Set up correctly: quiet before an answer, quiet after reject, sends after accept.	The correct setup

How to Read One

Start with the tiles at the top: how many findings are high, medium, low and for information. Then read the box under them, which says which banner PXTA found and how it answered it in each pass.