Tracker library
What a scan finds, and what to do about each one.
The classification catalogue behind a StrongPrivacy scan carries over 130 host rules and more than 40 cookie-name rules. These pages cover the ones that turn up most: what each vendor is, which hosts and cookies identify it, which consent category it belongs in, and how to hold it until the visitor agrees.
Google Analytics
A web-measurement service that may be installed directly, through a tag manager, or through a platform integration—sometimes by more than one path.
Vendor: Google
Google Tag Manager
A container rather than a single-purpose tracker. Its published configuration can load technologies that are absent from the application repository and can change independently of an application deploy.
Vendor: Google
Google Ads and DoubleClick
Conversion tracking and remarketing, delivered across several Google domains and usually arriving through a tag manager rather than as its own snippet.
Vendor: Google
Meta Pixel
Meta’s browser advertising pixel, which can be installed directly, through a container or by a platform app and therefore needs duplicate-path checks.
Vendor: Meta (Facebook, Instagram)
TikTok Pixel
TikTok’s advertising pixel, which a scan separates from an embedded TikTok video: two very different things served from adjacent domains.
Vendor: TikTok
Klaviyo
The one vendor in the catalogue that is split across two categories, because its signup forms and its behavioural tracking are genuinely different things.
Vendor: Klaviyo
LinkedIn Insight Tag
The B2B equivalent of an advertising pixel: conversion tracking, retargeting and company-level audience insight, with an unusually long cookie list.
Vendor: LinkedIn (Microsoft)
Microsoft Advertising (UET)
Universal Event Tracking: Microsoft’s conversion and remarketing tag for Bing ads, matched on bat.bing.com ahead of the broader Microsoft rule.
Vendor: Microsoft
Microsoft Clarity
Free session recording and heatmaps from Microsoft. Classified as analytics, but session replay captures far more than a page-view counter and deserves a closer look.
Vendor: Microsoft
Hotjar
Heatmaps, session recordings and on-site surveys. A large family of cookies, all prefixed `_hj`, and the same masking considerations as any replay tool.
Vendor: Hotjar (Contentsquare)
HubSpot
A CRM whose tracking script identifies visitors and ties them to contact records, which makes it marketing in substance even though its script hosts classify as analytics.
Vendor: HubSpot
Pinterest Tag
Conversion tracking and audience building for Pinterest ads, installable directly, through a tag manager or through a platform integration.
Vendor: Pinterest
Snap Pixel
Snapchat’s advertising pixel: conversion tracking and audience building, in the same shape as Meta’s and TikTok’s.
Vendor: Snap
Reddit Pixel
Reddit’s conversion pixel, increasingly common on developer-tool and consumer-subscription sites.
Vendor: Reddit
Segment
A customer data platform: one collection library that fans events out to many destinations. Like a tag manager, it is the delivery mechanism rather than the purpose.
Vendor: Twilio Segment
Mixpanel
Product analytics: events, funnels and cohorts tied to a distinct identifier, usually on an authenticated product rather than a marketing site.
Vendor: Mixpanel
Amplitude
Product analytics in the same family as Mixpanel: behavioural cohorts and retention analysis, usually keyed to a known user.
Vendor: Amplitude
PostHog
Product analytics with session replay and feature flags, frequently self-hosted, which changes the data-transfer question but not the consent one.
Vendor: PostHog
Matomo
Open-source analytics, often self-hosted and often chosen specifically because it can be configured to need no consent, which depends on the configuration, not the product.
Vendor: Matomo
Adobe Experience Cloud
An enterprise suite rather than one tracker: Analytics, Target, Audience Manager and the tag system, with a cookie footprint that spans several domains.
Vendor: Adobe
Intercom
Live chat and in-app messaging, classified as functional because a visitor who opens a chat expects the chat to work, but it is not automatically consent-exempt.
Vendor: Intercom
Zendesk
Support widget and help-centre embed, classified as functional for the same reason as any chat tool, and with the same argument for loading it on demand.
Vendor: Zendesk
Stripe
Payments and fraud prevention. On an active checkout, Stripe may support a service the visitor requested; sitewide loading and Stripe’s separate controller activities need a distinct, documented analysis.
Vendor: Stripe
Shopify platform
Shopify’s purpose-specific storefront storage plus app-added technologies, which must be inventoried separately from the platform itself.
Vendor: Shopify
YouTube embeds
An embedded media integration for which the `youtube-nocookie.com` domain changes personalization behavior but does not promise zero requests or storage.
Vendor: Google
Vimeo embeds
The usual alternative to YouTube, with a lighter tracking posture and the same structural issue: an embed is third-party code in your page.
Vendor: Vimeo
Google Fonts and web fonts
A font is not inherently a tracker, but remote loading sends a network request, including an IP address, to the font host. One Munich Regional Court decision treated a particular non-consensual Google Fonts disclosure as an infringement.
Vendor: Google, Adobe, Fontawesome
OneTrust
A consent platform whose narrowly scoped preference cookies may be necessary to remember a choice. The exemption depends on the exact purpose and payload, not the vendor name.
Vendor: OneTrust
Cookiebot
A consent platform whose `CookieConsent` cookie is one of the most recognisable strings in any cookie audit.
Vendor: Usercentrics
Start with your own site
A free scan names what is loading before anyone has chosen anything.