A Quarterly Tracking Sweep for Privacy and Legal Teams, With Evidence Kept on File

A privacy team usually learns what the website sends from the marketing team’s description of it. That description is honest and almost always incomplete, because tags change faster than anyone writes them down. A sweep every quarter, run by the privacy team itself, gives it its own record.

PXTA suits this because its output is built to be filed. One folder per site per quarter, each with a report a lawyer can read and a raw capture with a checksum.

The Sweep

for site in www.example.com shop.example.com help.example.com; do
  pxta audit "https://$site" --pages 40 --out "sweep-2026-q4/$site" --quiet
done
sha256sum sweep-2026-q4/*/requests.har > sweep-2026-q4/SHA256SUMS

Each report already prints the SHA-256 of its own requests.har. The extra SHA256SUMS file lets you check the whole quarter’s captures at once.

Reading the Results

Start with each report’s consent behaviour table. Any tracker not marked “respects the choice” goes on the list, with the finding sentences as the description. Then read the high findings: personal data, pages about health or money, and search terms going to ad networks.

The findings use fixed codes, such as tracker-after-reject or sensitive-page, and findings.json carries the same data as the report. A spreadsheet of codes per site per quarter shows quickly whether things are getting better.

What It Is and Isn’t

PXTA records traffic and draws no legal conclusion. The report says so in its Method section, and it lists what a browser can’t see: server-side tagging and conversion APIs, pages behind a login, and clicks PXTA didn’t make. Those need asking about separately. The counsel post covers the evidence side in more detail, and the explainer on what a browser audit can’t see covers the gaps.

Audit sites your organisation runs or has permission to test.