Tracker and embed checker

A third-party resource is a file loaded from another company's domain. A third-party cookie is a cookie whose domain belongs to another company. They are not the same thing and one does not imply the other.

A script can be loaded from a third party and set no cookie at all. A cookie can be set by your own domain and carry an identifier to a third party.

The checks keep them separate for that reason, and cookies are read from real response headers rather than inferred from the presence of a script.

An audit that reported every third-party script as a tracking cookie would be wrong on most sites, and wrong in the direction that is expensive to act on.

A link to an external service contacts nobody until someone clicks it. It is a URL in the page and nothing more.

An embedded frame contacts that service as soon as the page loads, for every visitor, whether or not they interact with it.

So a map link and an embedded map are meaningfully different, and the check reports which one is present rather than treating the vendor's name as the finding.

The same applies to video: a standard embed contacts the provider on load, and the privacy-enhanced host defers part of that. Which one is in use is visible in the markup.

Form-protection widgets sit in the same category. They serve a real purpose and they are also a third-party script, and the point is that the trade should be a decision rather than a default.

Whether a consent mechanism is present in the served markup, and whether accept, reject and preference controls are observable in it.

Whether trackers execute before a choice has been made, which is read from what the page actually loads rather than from what the banner says it will do.

Whether a cookie policy page, or a cookie section inside a privacy policy, is published and reachable.

None of this establishes that the mechanism works. Whether a choice is recorded, honoured and re-offered is behaviour, and behaviour needs a browser session.

Which is why the summary is a consolidated list of what was observed, and explicitly not a verdict on any obligation.

A tracker loaded twice on the same page counts every visit twice, which inflates page views and, on an advertising platform, conversions.

It happens when a tag is added both through a tag manager and directly in a template, and neither owner knows about the other.

Several distinct identifiers for the same product are a different matter and are frequently intentional — a separate property for a subdomain, a client's own tag on an agency-built site.

The check separates the two, because reporting deliberate multi-account setups as duplicates would be noise on exactly the sites that are configured carefully.

`privacy.tracker_inventory` consolidates every tracker the detector could see, plus the ones it could not. `privacy.duplicate_trackers` separates a tag loaded twice from several deliberate identifiers.

Individual detections cover the common products by their real script hosts and markup fingerprints, including session-replay and advertising pixels.

`privacy.google_maps`, `privacy.youtube_embeds` and `privacy.recaptcha` distinguish a link from an embed, and note where a privacy-enhanced host is used.

`privacy.cookie_banner`, `privacy.reject_option` and `privacy.trackers_before_consent` read the consent mechanism. `privacy.third_party_cookies` reads real cookies, kept distinct from resources.

`privacy.cookie_policy` looks for a published policy, and `privacy.observable_summary` consolidates the observations — never a compliance verdict.

Detection is from served markup and known script hosts. A tracker injected by a tag manager after load, or proxied through your own domain, may not be recognised — and the inventory says what it could not see rather than implying completeness.

No legal conclusion is drawn. What obligations apply to your site depends on your jurisdiction, your audience and your purposes, none of which a scan knows.

Whether the consent mechanism records and honours a choice is not tested. Only its presence in the markup and what loads before a choice are observed.

Pages behind a login are outside the crawl, so trackers that only load there are not in the inventory.