Field Results
What Five Layers Find That One Layer Misses
Every result below is from a real Pre-Consent Check. Client names, URLs, and identifying details are removed. The findings are not. Each report carries a SHA-256 hash that locks the page state at the moment of capture.
K-12 Education
California School District — 14 Sites, 47 Trackers Found
A California K-12 district requested a check across its public-facing sites after a neighboring district received a demand letter. The district had a consent banner on its main domain. It assumed that was sufficient.
Key Finding
Meta Pixel was firing on the enrollment and staff-directory pages before any consent interaction. A server-side relay was forwarding form submissions to a third-party analytics vendor outside the consent path entirely. The consent banner had no control over either transmission.
Trackers — Source-Only Scanner
6
Trackers — TrackGuard Pro
47
Banner-Independent
19 of 47
Healthcare
Regional Hospital Network — Meta Pixel on Patient Portal Login
A multi-facility hospital system engaged TrackGuard Pro after the BetterHelp and MarinHealth settlements made headlines. Their marketing team had installed Meta Pixel for ad campaign tracking two years prior.
Key Finding
The Meta Pixel was present on the patient portal login page, capturing URL parameters that included appointment-type identifiers. A window.fbq call executed on page load — before any consent interaction and before any login. The pixel tag was not visible in the HTML source; it was injected by Google Tag Manager at runtime.
Source-Only Scanner
Pixel not detected
TrackGuard Pro — Layer 3 (Window Globals)
window.fbq active
Statutes Commonly Cited
HIPAA · CIPA
E-Commerce
Multi-Brand Retailer — Conversions API Running Parallel to Pixel
An online retailer with four storefronts believed its consent platform was handling all tracker gating. A competitor had just settled a CIPA claim for seven figures. The retailer's counsel requested independent verification.
Key Finding
Meta's Conversions API (CAPI) was transmitting purchase events server-side, parallel to the browser pixel. Because CAPI originates from the retailer's own server, the consent banner was not in its path. The consent platform's dashboard showed "all trackers gated" — a statement about browser-side calls only.
Browser-Side (Gated)
12 trackers
Server-Side (Ungated)
4 transmissions
Consent Platform Visibility
0 of 4 server-side
Higher Education
University Admissions Portal — Tag Manager Relay Pattern
A state university's admissions office ran paid campaigns on Meta and Google. Their IT department confirmed the consent banner was "properly configured." The admissions team requested verification before the fall enrollment cycle.
Key Finding
Google Tag Manager was configured to route tracking calls through the university's own subdomain before forwarding them to third-party endpoints. From the browser's perspective, the calls appeared to be first-party. TrackGuard Pro identified the relay by request timing and payload signatures — Layer 5 detection.
Relay Destinations Identified
3
Visible to Browser Tools
0 of 3
Pages Affected
Admissions · Financial Aid · Campus Visit
See What’s Running on Your Site
The free Pre-Consent Check takes one URL. You get a summary of which trackers fire before consent, which layers they were found on, and which statutes are commonly cited. No account required.
Run a Free Check