About

pxta.com is the home of PXTA, short for Pixel Tracking Audit. It’s a free command-line tool that crawls a website in a real browser and writes down what every tracking pixel sends, where it goes, and whether it went before the visitor answered the cookie banner. The report it produces is a list of findings, each one a plain sentence with the request that proves it.

The Name

PXTA is PiXel Tracking Audit. “px” has been shorthand for pixel for as long as screens have had them, from CSS widths to image editors, and a tracking pixel is where this whole kind of tracking started: a one-by-one image, invisible on the page, whose only job was to make the browser call home with some details attached. Today most “pixels” are scripts, but the name stuck, and marketing teams still talk about “installing the pixel”. So the tool that checks them borrows the old shorthand, then says what it does: tracking, audited. The post about the name has the longer story.

Why It Exists

Most sites don’t know what their own pages send. Marketing adds a pixel for a campaign, a plugin brings another, a tag manager loads three more, and years later nobody has looked at what any of them transmit from a checkout page or a page about a medical condition. Consent banners make it look handled. Often it isn’t: tags load before anyone clicks, or keep loading after a visitor says no.

Those requests have become a legal question as well as a technical one. In the US, class actions under wiretap and video-privacy laws have gone after pixel use. Health regulators have warned hospitals and clinics about tracking on their sites. European regulators keep fining consent failures. When a lawyer, a privacy officer or an agency needs to know what a site does, they need the requests themselves, page by page.

How It Works

• A real browser. PXTA drives Chrome, Chromium or Edge, so pages run their scripts exactly as they do for visitors, banners and tag managers included.
• Three visits per page. With the banner left alone, after rejecting, and after accepting, each in a fresh browser profile. That shows what fires too early and what ignores a “no”.
• Every request. From the page, from its iframes and workers, and from the beacons a page sends as the visitor leaves.
• Decoded and checked. Each value is unpacked, from URL encoding, base64, JSON, and addresses inside addresses, and checked for email addresses, hashes of them, phone numbers, names, user IDs, search terms and pages about health or money.
• Evidence you can hand on. One self-contained HTML report, the same findings as JSON, and every request in a HAR file whose checksum the report prints.

License

All the code is open source under the Apache License 2.0, on GitHub. PXTA is a SoftDevStudio.com project.

Questions People Ask

Is it free?

Yes, and the code is free to take and change under the Apache License 2.0.

Does PXTA say whether a site is legal?

No. It records network traffic and says what was sent, when and where. Whether that breaks a law depends on the law, the site and the visitor, and that’s a question for a lawyer. The report says this in its Method section.

Can I audit a site that isn’t mine?

PXTA loads public pages the way any visitor’s browser does, one page at a time with a pause between them. It follows robots.txt and names itself in the user agent. It doesn’t sign in, submit forms or get past anything a visitor couldn’t.

Does PXTA send my results anywhere?

No. There’s no telemetry. The reports are written to a folder on your machine, and nothing leaves it unless you send it.

What can’t it see?

Data a site sends from its own servers, such as conversion APIs and server-side tag managers, never passes through the browser, so no browser-based tool can see it. Version 0.1 doesn’t sign in, so pages behind a login aren’t covered.

How is it different from a cookie scanner?

Cookie scanners list cookies and, sometimes, the scripts that set them. PXTA looks at what leaves the browser: the requests, their contents and their timing against the consent choice. A site can set no new cookie and still send an email address to an ad network.

Can I suggest a tracker or a banner it should know?

Please do. The contact page has the address, and the tracker catalog is a folder of small JSON files on GitHub.