Tracking audit of www.tidewaterbakery.test

25 October 2026, 16:07 UTC · 3 pages · PXTA 0.1.0, tracker catalog 2026.10.25

0high
0medium
1low
2for information
PXTA found a consent banner from Didomi, and visited each page 3 times: Banner not answered, After reject, After accept. For the accept pass it clicked #didomi-notice-agree-button. For the reject pass it clicked #didomi-notice-disagree-button. There is no score: each finding names the page, the tracker and the data, with the request that carried it.

Findings

LOWOn /order, the Meta Pixel sent a SHA-256 hash of the email address [email protected] after the visitor accepted tracking.

personal-data · Meta Pixel
Evidence
GET https://www.facebook.com/tr/?id=88123004417&ev=SubscribedButtonClick&dl=https%3A%2F%2Fwww.tidewaterbakery.test%2Forder&rl=&if=false&ts=1792944464481&v=2.9.fixture&ud%5Bem%5D=d8f3ef4a8f2657afef29b4d64189cc2c74886e9f0f3336e7049449c9d11af89a

2026-10-25T16:07:44.483Z · Image from the page · while the page was being scrolled and filled in

FieldValueMeaning
id88123004417pixel ID
evSubscribedButtonClickevent name
dlhttps://www.tidewaterbakery.test/orderpage address
rlreferring page
iffalse
ts1792944464481
v2.9.fixture
ud[em]d8f3ef4a8f2657afef29b4d64189cc2c74886e9f0f3336e7049449c9d11af89aemail address (hashed)

Flagged: a SHA-256 hash of the email address [email protected] in ud[em].

Trackers on the site

TrackerVendorBanner not answeredAfter rejectAfter accept
Google Analytics 4Googlenot seennot seensent data on 3 pages
Meta PixelMetanot seennot seensent data on 3 pages

Consent behaviour

TrackerBefore an answerAfter rejectAfter acceptIn short
Google Analytics 4quietquietsends datarespects the choice
Meta Pixelquietquietsends datarespects the choice

Pages visited

Pass#PageRequests
Banner not answered0https://www.tidewaterbakery.test/3
Banner not answered1https://www.tidewaterbakery.test/menu2
Banner not answered2https://www.tidewaterbakery.test/order2
After reject0https://www.tidewaterbakery.test/2
After reject1https://www.tidewaterbakery.test/menu2
After reject2https://www.tidewaterbakery.test/order2
After accept0https://www.tidewaterbakery.test/6
After accept1https://www.tidewaterbakery.test/menu6
After accept2https://www.tidewaterbakery.test/order7

Method

PXTA loaded each page in headless Chrome/153.0.8010.12 with a fresh browser profile for each pass, waited until no new request had started for 2s (at most 15s per page), scrolled to the bottom, typed the marker address [email protected] into email fields without submitting anything, then left the page so beacons sent on unload were recorded too. Requests from iframes and workers are included.

User agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.0.0 Safari/537.36 pxta/0.1.0 (+https://pxta.com). Robots.txt was respected. Up to 10 pages, 3 links deep.

Email addresses whose SHA-256 and MD5 hashes were looked for: [email protected].

What PXTA cannot see. Data a site sends from its own servers (server-side tagging, conversion APIs) never passes through the browser. Pages behind a login were not visited. A tracker that fires only after a click PXTA didn't make is not in this report.

What this report is. A record of network traffic. It draws no legal conclusion about whether the site complies with any law.

The raw capture is in requests.har, SHA-256 9ad0bd5f32f05cb1a8d9166505d679b067f277908ecb2d2095ac97d31a131246, and every finding is in findings.json.