Pixel Auditor: Tag, PII & Consent Mode Inspector

Description

Inspect every tracking pixel firing on a page: tag IDs, event payloads, consent-mode signals, cookies, and PII leaks. Pixel Auditor is a real-time tracking pixel auditor and inspector for marketers, analysts, and developers. Open the side panel on any website and instantly see every tracking tag on the page, watch events fire live, and audit your implementation. No separate tools. No DevTools. No technical setup required, no cost. ────────────────────────────────────── SEE WHAT'S FIRING, LIVE ────────────────────────────────────── Live event stream shows every tracking request as it happens: platform, event name, the method used to fire it, full payload, and fire latency. Regex search, platform filters, pause/resume recording, and watched-event notifications (per-site or global) help you focus on what matters. Take a snapshot at any point and see which fires are new since then. ────────────────────────────────────── SUPPORTED PLATFORMS ────────────────────────────────────── Detects tracking tags from the major tag management, analytics, and advertising ecosystems commonly deployed on the modern web. Identification combines script-src scans, inline initialization code, dataLayer configuration, and live network traffic, so tags are caught whether they load synchronously, async, or through a consent-gated injector. ────────────────────────────────────── CONSENT MODE AUDITING AND SIMULATION ────────────────────────────────────── Inject Grant All or Deny All Consent Mode v2 states with one click and watch exactly which tags respect consent. Auto-clicks the real CMP banner across 19 of the most widely deployed consent management platforms, covering enterprise tooling, popular CMS plugins, and newer independent vendors, with a text-based fallback for custom banners. Every fire is classified against Consent Mode v2 semantics so compliant modeling pings are distinguished from real consent violations. A Reset Consent button clears site cookies, localStorage, and sessionStorage so the banner re-prompts for a clean test. ────────────────────────────────────── PII LEAK DETECTION ────────────────────────────────────── Scans every outgoing tracking hit for emails, phone numbers, and more than fifteen named identifying fields such as full name, date of birth, government IDs, and address components. Flags hashed identifiers (SHA-256, SHA-1) when they appear in identity-shaped parameters. Contextual heuristics avoid noise from unrelated platform metadata. ────────────────────────────────────── SERVER-SIDE TRACKING DETECTION ────────────────────────────────────── Catches first-party proxied tracking that standard pixel checkers miss. Supports server-side tag manager implementations routed through custom domains or managed hosts, server-side conversion APIs used by the major social and ad platforms, and enterprise-grade edge-layer tag forwarders. Multi-source detection: inline script scan, runtime dataLayer inspection, container-state probing, and network-level classification of every captured fire. ────────────────────────────────────── AUDIT REPORTS, HEALTH SCORING, AND SAVED RUNS ────────────────────────────────────── Every session includes an A through F health score with prioritized issues such as duplicate installs, pre-consent fires, missing measurement IDs, dormant tags, and funnel mismatches. Save any audit state as a named run and diff it against future sessions to validate deploys. Export a shareable single-file HTML report. ────────────────────────────────────── INTERFACE ────────────────────────────────────── Dark and light themes with a header toggle. Self-hosted fonts so nothing loads at runtime. Every icon is an inline SVG that themes cleanly. The detail drawer is drag-resizable. ────────────────────────────────────── ABOUT THE DEVELOPER ────────────────────────────────────── Pixel Auditor is built and maintained by Ratan Jha. Every detection rule, classifier, and heuristic in this extension is grounded in years of hands-on experience auditing real-world tracking implementations, consent management deployments, and server-side tag setups. The tool reflects how tracking is actually done, and how it typically breaks, in production environments, not textbook examples. ────────────────────────────────────── WHO IT'S FOR ────────────────────────────────────── Digital marketers verifying tag implementations Analysts checking event data quality Developers debugging tracking integrations Conversion and paid media teams auditing pixel setups Agencies auditing client websites before go-live ────────────────────────────────────── PRIVACY ────────────────────────────────────── All audit data stays on your machine in chrome.storage.local. Pixel Auditor makes zero outbound requests of its own and never transmits any data to the developer or any third party. The broad host permission exists solely so detection can run on any site you choose to audit. Full privacy policy: https://pixelauditor.ratanjhadigital.com/privacy.html Not affiliated with any analytics, advertising, or consent management vendor. All trademarks are property of their respective owners. ────────────────────────────────────── The V2.5.4 ────────────────────────────────────── - Bug fixes and accuracy improvements Per-hit consent decoding (gcd) — every hit's drawer now shows the consent state Google actually received (all four Consent Mode v2 signals, including whether each came from a CMP default or a user update), with an explicit warning when Consent Mode isn't active on the hit at all. CAPI dedup audit — when server-side dedup is in use, browser events missing the eventID get a "NO DEDUP ID" badge, a drawer explanation, and an Audit-tab section — these are the events Meta may double-count. CSP-blocked fire detection — tracking requests refused by the site's own Content-Security-Policy are flagged ("CSP BLOCKED" badge, Audit section, health-score deduction) instead of silently counted as delivered. Found live: a site whose conversion pings never reached Google. Page Summary — a plain-language paragraph at the top of the Audit tab and HTML report: what runs on the page, what fired, consent posture, and what's broken. Fixes Server-side tracking detection no longer false-positives Meta network events now show the event name ("PageView") instead of the raw request URL in the Live Events stream and drawer title. HTML report: new "CSP-Blocked Fires" compliance stat, CSP endpoint table, and the Page Summary paragraph up top. CSV export gains a "CSP Blocked" column. ────────────────────────────────────── What's New in V2.5.6 ────────────────────────────────────── NEW — Conversion Reconciliation: every ad platform's record of the same purchase side by side (conversions, order ID, value, currency, dedup ID, customer data), flagging duplicate conversions and mismatched order IDs or revenue across platforms. NEW — Enhanced Conversions audit: confirms whether customer data for Google Ads and Microsoft UET is actually captured AND sent. Field names only; no personal data shown or stored. IMPROVED — Bing UET: named events (Add to Cart, Purchase, custom goals) now show their real names instead of "custom" or a number. IMPROVED — Next.js/React apps: tracking is detected across client-side navigations and for late-loading tags. FIXED — no more duplicate rows for one event, conversions for different orders are never merged, product IDs now shown, and exports include all audit findings. ────────────────────────────────────── What it tells you ────────────────────────────────────── Tag IDs (G-XXXX, AW-XXXX, MC-XXXX, ca-pub-XXXX, pixel IDs, partner IDs, UET ti, etc.) Every event fire — name, payload, timing, dedup-aware grouping dataLayer pushes with a Sent / Silent / Pending state machine Consent Mode v2 timeline + a built-in simulator that injects gtag('consent','update') and shows what fires in the next 5 seconds One-click CMP banner accept / reject for 30+ vendors High-recall PII leak detection: emails, phone numbers, hashed identifiers Cookie audit for 20+ tracking cookies A–F health score with actionable reasons HTML and JSON exports + saved runs for before/after deploy comparison Real-time desktop notifications when a high-severity consent breach fires Everything runs locally in your browser. No data leaves your machine.

Details & SEO