Explainers on pxta.com

A Hashed Email Address Still Identifies Someone, Here Is How Ad Networks Match It

Sun, 25 Oct 2026 00:00:00 +0000

Almost every ad network now offers a way to send customer details from a website “securely hashed”. Meta calls it advanced matching, Google calls it enhanced conversions, Pinterest calls it enhanced match. The tag runs the visitor’s email through SHA-256 and sends a 64-character string instead of the address.

That sounds like anonymisation. It isn’t, and the networks don’t claim it is. The whole point of the feature is to find the person.

Google Consent Mode gcs Values Explained, What G100, G110, G101 and G111 Mean in a Request

Sun, 25 Oct 2026 00:00:00 +0000

Google Consent Mode is how a cookie banner tells Google’s tags what the visitor agreed to. The site sets defaults when the page loads, usually “denied”, and updates them when the visitor answers. Google’s tags then add the current state to every request they send, in a short field called gcs.

Four characters, and most people never look at them. They’re worth reading, because they show what the tags were told at the moment each request left the browser.

How Site Search Terms Leak to Ad Trackers Through the Page Address

Sun, 25 Oct 2026 00:00:00 +0000

A site’s own search box is where visitors type what they actually want. On a pharmacy it’s a medicine. On a lender it’s “bankruptcy”. On a clinic it’s a symptom. Nobody types those into a page title, but they type them into search.

Most sites put the search in the page address: /search?q=pregnancy+test. And nearly every tracker sends the page address with every event. Put the two together and the search goes to every ad network on the page.

Tracking Requests From Iframes and Web Workers, the Ones a Page Source Check Never Finds

Sun, 25 Oct 2026 00:00:00 +0000

The quickest way to see which trackers a site uses is to read its HTML and look for known scripts. Plenty of free tools do just that. It finds the Meta Pixel in the page template, and it misses everything that isn’t there.

Two places hide tracking from that kind of check: iframes and web workers.

What a Browser Tracking Audit Can't See, Server-Side Tagging and Conversion APIs

Sun, 25 Oct 2026 00:00:00 +0000

PXTA watches what leaves the browser. That covers most tracking on most websites, and it’s where the consent questions are sharpest, because it’s the visitor’s own device doing the sending. But it’s not everything, and a report that says nothing about the rest would be easy to misread.

So here’s the part a browser can’t see, stated plainly.

What a Tracking Pixel Sends Before You Click Accept, One Request at a Time

Sun, 25 Oct 2026 00:00:00 +0000

A tracking pixel is a small piece of code an advertising or analytics company gives a website. The site pastes it into its pages, and from then on every visitor’s browser reports to that company. Meta, Google, TikTok, LinkedIn, Microsoft, Pinterest, Snap and X all have one. A typical shop runs several.

What the pixel reports is decided by the pixel and by how the site set it up. The visitor never sees it. Here is what’s actually in one of those reports, and why it matters when it goes out before anyone clicks “Accept”.

What Websites Send When You Close the Page, and How PXTA Records Unload Beacons

Sun, 25 Oct 2026 00:00:00 +0000

A lot of tracking happens on the way out. Analytics tools want to know how long someone stayed and how far they scrolled, and the only moment they know that is when the visitor leaves. So scripts wait for the page to be hidden or closed, then send a last request with navigator.sendBeacon, which the browser delivers even as the page goes away.

These requests are easy to miss. Open the browser’s developer tools, click a link, and the network list clears for the new page, unless “Preserve log” was ticked first.