Every technical term that appears in a check, in plain English. These are the real words your developer uses, so you can repeat the finding to them without translating it first.
also called: pixel, script, snippet
A small piece of code sitting on a page that sends information to an outside company when the page opens.
A pixel is a tag that loads as a tiny invisible image. Same job, different shape. Your developer will call them tags.
for example: Google Tag Manager, GTM
A control panel that loads tags onto your site without anyone editing the page itself.
This is why trackers reappear. Anyone with access to the container — an agency, a contractor, a staff member running one campaign — can add a tag at any time, without touching your code and without telling you.
An add-on installed into your website platform to give it a feature it did not have.
Plugins update themselves. A version released overnight can ship a new tracking layer switched on by default, already running on every visitor since the update.
for example: Microsoft Clarity, Hotjar, FullStory
A tool that records what happens on the page — clicks, scrolling, movement, sometimes what is being typed — so it can be replayed later as a video.
On a page with a form, this is the finding most owners sit up for. It is the difference between counting visitors and watching them.
A tool that reads what is entered into a form and sends it to an outside company.
It can fire before anyone presses submit, which means a name and an email can reach a third party before they reach you.
also called: first-party endpoint, CAPI, server-side GTM
Data sent to an address on your own domain, which your server then forwards on to an outside company.
This is the one nothing else catches. In the page source it looks like a request to your own site. Ad blockers miss it. Consent tools miss it. Removing the tag from the page does not necessarily stop it, because the forwarding happens on a server.
What is already running before a visitor has agreed to anything.
This is the whole subject of a check. Not whether you have trackers — almost everyone does — but whether they started before the question was asked.
Holding trackers back until a visitor has actually pressed something on the cookie consent box.
Roughly seven in ten sites that act on a check gate their trackers rather than removing them. Expect your analytics numbers to drop when you do, because those tools now only count visitors who pressed accept.
for example: CookieYes, OneTrust, Cookiebot
The panel asking whether it is alright to collect information.
The earliest moment the box could have appeared is always earlier than the moment it became visible.
SHA-256
A fingerprint of the whole packet: the page address, the timestamp, and every finding with its timings.
Re-running the same check on an unchanged page reproduces the same value. If the packet is altered after delivery, it does not.
The statutes usually named in connection with a given technology.
Naming one is not a finding about your site, and nothing in a packet states what any of them means for you. That is a question for your lawyer. We are not a law firm and we do not give legal advice.