F-01core
Real-Time Tag Detection
Scans JS globals, DOM scripts, cookies, and network requests in parallel. MutationObserver catches async-loaded tags. Re-scans at 0 ms / 800 ms / 2.5 s / 5 s.
v2.5 — Free Chrome extension, no account
Inspect every tracking pixel, in real time.
Pixel Auditor is a Chrome side panel that detects, validates, and audits tracking tags across Google Analytics, Google Ads, Google Tag Manager, Meta Pixel, LinkedIn Insight, Microsoft Bing UET, Microsoft Clarity, Segment, Tealium, Hotjar, Criteo, and Klaviyo — plus any server-side proxy or vendor API on top.
01 — Coverage
Detects every tag
Detects every tag
worth detecting.
Hooks the JS layer, sniffs the network, parses cookies, and reads the DOM — simultaneously. Server-side fires are classified by hostname against canonical vendors.
Google Analytics
G-XXXXXXX
01Google Ads
AW-XXXXX
02Google Tag Manager
GTM-XXXXX
03Google Merchant Center
MC-XXXXX
04Meta Pixel
fbq()
05LinkedIn Insight
_linkedin_partner_id
06Microsoft Bing UET
uetq.push()
07Microsoft Clarity
clarity()
08Segment
analytics.load()
09Tealium
utag.js
10Hotjar
_hjSettings
11Criteo
criteo_q
12Klaviyo
company_id=
13Server-Side Tracking
sGTM (incl. renamed paths & encoded transport), first-party proxies, vendor server APIs
14
02 — Capabilities
Everything a marketer
Everything a marketer
or developer needs.
v2.5 adds IAB privacy-framework auditing, per-hit consent decoding, Meta CAPI dedup checks, CSV export, and cross-run comparison on top of the v2.0 foundation — and 2.5.4 closes Meta's form-POST transport gap, captures Shopify's trackShopify events, and flags tags that are installed but never fire. See full docs → · Version history →
F-02v2.0
PII Leak Detector
Scans every fire's URL and parsed payload for raw emails, phone numbers, and 15+ named PII fields. Short-code heuristics validate the value before flagging — so em=marketing doesn't trip a false alarm.
F-03v2.0
Consent Mode Classifier
Reads the gcs= param Google stamps on every Consent Mode v2 ping. Distinguishes denied-state modeling, plumbing events, real violations, and inconsistent fires.
F-04v2.0
Consent Mode Simulator
Inject Grant or Deny via gtag('consent','update') and watch the 5-second diff of what re-fires. One-click "Accept / Reject via CMP" auto-clicks across 19 supported CMP vendors.
F-05v2.0
Server-Side Tracking Detector
Multi-source: script-text scan + live dataLayer inspection + runtime hooks + network classification against canonical vendor hostnames. Surfaces the actual proxy domain. Confidence-fuses converging signals.
F-06v2.0
Tag Latency Badge
Every captured fire is stamped with performance.now(). Rendered as a tinted badge: green <500 ms, yellow 500–2000 ms, red >2 s. Spot the pixel hanging the conversion.
F-07core
Live Event Stream
Intercepts gtag(), fbq(), uetq.push(), clarity() in real time. Three-layer dedup. Per-platform filters. Severity left-bar and latency badge per row.
F-08v2.0
Event Search + Regex Filter
Plain text matches across platform / event name / method / account ID / URL. Wrap in /…/flags for a live JS regex literal.
F-09v2.0
Pause / Resume Recording
DevTools-style toggle in the Live Events action bar. Paused state drops incoming fires; tooltip shows running drop count. Past events stay interactive — no scrollback loss.
F-10core
Tag Health Scoring
A–F grade on a 100-point scale. Deductions for pre-consent fires, duplicates, retired tags, dormant IDs, missing measurement IDs, and missing required event params.
F-11v2.0
Saved Runs & Diff
Persist the full audit state — tags, events, cookies, consent, dataLayer, findings — under a name you choose. Load any saved run for a side-by-side diff. Capped at 10 runs per browser.
F-12v2.0
Multi-Watch (per-site & global)
Set a desktop notification for any event name. Per-site by default, with an "apply to all sites" toggle. Cross-tab firing — alerts trigger regardless of which tab the panel is focused on.
F-13core
Snapshot & Diff
Capture state. Keep browsing. A live diff banner shows exactly what changed since you snapped. New rows get a green NEW badge. Useful for verifying that a UI interaction triggered the correct tag.
F-14core
DataLayer Inspector
Live, searchable log of every dataLayer.push(). Expandable JSON viewer. Pending → confirmed state machine: pushes flip to "silent" if no network hit lands within 2.5 s.
F-15v2.0
Light + Dark Themes
Manual toggle plus system-preference awareness. 27-icon SVG registry — every badge, button, and header themes cleanly via currentColor.
F-16core
Export Audit Report
One click → a single-file shareable HTML report with every tag, event, score, consent transition, cookie, PII finding, server-side signal, and violation. Send it. Sign it off.
F-17v2.4
IAB Privacy Frameworks
Reads the page's __tcfapi, __gpp, and __uspapi CMP APIs plus Global Privacy Control. TCF v2.2 purpose grid, GPP sections, US Privacy opt-out — and a fire audit that flags tags firing against denied TCF consent.
F-18v2.4
CSV Export
One click in the Live Events toolbar writes every captured fire — time, platform, event, method, account ID, pre-consent, missing params, PII, CSP-blocked, URL — as an RFC-4180 CSV for spreadsheets and pipelines.
F-19v2.4
Cross-Run Compare
Pick any two Saved Runs for a side-by-side delta: stat changes (tags, fires, pre-consent, PII, cookies, SST) plus added / removed / changed tags and cookie changes. Pre- vs. post-launch in one view.
F-20v2.5
Per-Hit Consent Decode (gcd)
Decodes the gcd parameter on every Google hit — the consent state the hit actually carried, per signal, with default vs. user-update provenance. Warns when Consent Mode isn't active at all.
F-21v2.5
Meta CAPI Dedup Audit
When browser + Conversions API dedup is in use, flags every Meta browser event missing its dedup event ID — the ones at risk of being double-counted as inflated conversions. Badge, drawer fix-note, and Audit section.
F-22v2.5
Page Summary & CSP Detection
A plain-language paragraph a client can read first: stack, fire counts, consent posture, PII, server-side tracking, and grade. Plus detection, scoring, and reporting of fires blocked by the site's CSP.
F-23v2.5.4
Meta Form-POST Capture
Meta routes its richest events — Advanced Matching, cart contents, CAPI event IDs, anything past 2 KB — through a hidden form POST no fetch/XHR/img hook ever sees. Pixel Auditor intercepts the form submission itself, closing the "Pixel Helper sees it, we don't" gap.
F-24v2.5.4
Shopify Meta Events
Shopify's Facebook & Instagram channel routes every Meta event through an undocumented fbq('trackShopify', …) call. Now fully parsed — PageView, ViewContent, AddToCart, Purchase, with CAPI event IDs — so the dedup audit works on Shopify stores too.
F-25v2.5.4
Silent-Tag Audit
"Installed but not firing" is now a finding: a tag whose library loaded and whose ID was extracted, but which sends nothing. Outlined red NO EVENTS badge, an Audit section naming each dead tag, and a health deduction.
F-26v2.5.4
webRequest Safety Net
An observational network layer in the service worker catches fires from sandboxed and opaque-origin frames — and transports no JS hook covers. It stands down whenever a richer page-sourced capture of the same fire exists, so nothing double-counts.
F-27v2.5.3
Export Redaction & PII Tiers
"Redact PII in exports" (default ON) scrubs JSON, CSV, and HTML deliverables — and saved runs never retain raw values. MD5/base64 digests are recognised as hashes, and pseudonymous IDs get their own medium severity tier. PII now counts against the health grade.
03 — Live events
Watch every fire as it happens.
Real-time stream with platform pill, event name, method, account ID, latency badge, and severity left-bar. Filter by platform, search by substring or regex, pause to inspect.
- →Per-row latency: green / yellow / red
- →Per-platform filter chips
- →Substring or
/regex/search - →Pause / Resume toggle, drops while paused
- →Click any row → drawer with full payload + validation
04 — Workflow
Up and running
Up and running
in 30 seconds.
-
01
Install from Chrome Store
One click. No account, no sign-up, no card. The extension runs entirely on your machine. Self-hosted fonts — zero outbound requests from the extension itself.
-
02
Open the side panel
Click the icon on any site. Pixel Auditor opens beside the page and starts scanning. Press the same icon again to close.
-
03
See everything, live
Tags, events, consent state, PII findings, server-side detections, audit grade. Real-time, with zero impact on the page. Save a run, snapshot, or export when done.
05 — Audit
Health score, consent, cookies, and a one-click report.
Every tag scored A–F on a 100-point scale. Consent timeline with gcs-classified states. Tracking cookies attributed to platform. Hit Export and a single self-contained HTML file lands in your Downloads — client-ready.
- →Plain-language Page Summary up top
- →A–F grade with weighted breakdown
- →Consent Mode timeline + violations · TCF / GPP / GPC signals
- →Built-in Consent Mode simulator
- →Cookie audit with platform attribution
- →Saved Runs · 10 per browser · diff or A/B compare
06 — For whom
Built for the people
Built for the people
who own the data.
role / 01→
Marketers
Verify every conversion fires once, with the right value, after consent. Catch PII leaks before legal does. Hand over clean reports.
- Verify purchase events
- Audit consent compliance (gcs-classified)
- Catch PII leaks per-fire
- Export shareable reports
role / 02→
Developers
Inspect dataLayer pushes, intercept gtag/fbq calls, see network payloads — without console.log scaffolding. Pause, search by regex, save runs.
- Live event interception
- Full payload + latency
- Server-side detection
- Saved Runs + side-by-side diff
role / 03→
Agencies & auditors
Audit any client site in 30 seconds. Send a branded report. Compare pre- and post-launch with Saved Runs. Bill for the diagnosis.
- Cross-site comparison
- One-click HTML reports
- Snapshot + Saved Runs diff
- Zero install for clients
07 — Privacy
Nothing leaves your browser.
All analysis happens on-device. v2.0 self-hosts its fonts — the extension makes zero outbound requests
to Google Fonts or any other third party. Saved Runs and watches live in chrome.storage.local.
→No accounts
→No telemetry
→No external requests
→No paid tier, ever
01What's new in 2.5?
The 2.3–2.5 releases add five new platforms (Segment, Tealium, Hotjar, Criteo, Klaviyo), IAB privacy-framework auditing (TCF v2.2, GPP, US Privacy, GPC), per-hit consent decoding of Google's gcd parameter, a Meta CAPI dedup audit, a plain-language Page Summary, CSP-blocked fire detection, CSV export, cross-run compare, stronger server-side GTM detection (renamed paths, base64-encoded transport), and a security-hardened storage/messaging layer. The latest 2.5.4 update closes Meta's form-POST transport gap (the "Pixel Helper sees it, we don't" cases), captures Shopify's trackShopify events, flags tags that are installed but never fire, adds a webRequest safety net for sandboxed frames, and redacts PII in exports by default. See What's new in 2.5 and the version history for the full list.
02Does it actually detect PII leaks in tracking pixels?
Yes. v2.0 scans every captured fire's URL and parsed payload for raw emails, phone numbers, and 15+ named PII fields (email, phone, first_name, last_name, dob, ssn, zip, address, etc.). Short-code parameters (em, ph, fn, ln) are heuristically validated — the value has to actually look like PII before it's flagged. Findings are tiered per-platform.
03Which CMP vendors does the Consent Mode Simulator support?
19 vendors with one-click "Accept via CMP" / "Reject via CMP" auto-clicks: OneTrust, Cookiebot, CookieYes, Complianz, Klaro, Didomi, Quantcast, TrustArc, Osano, Usercentrics, CookieLawInfo, Iubenda, Sourcepoint, Termly, Ketch, Axeptio, tarteaucitron, WP-GDPR (WPEka), and Secure Privacy. For custom or in-house banners, a generic text-based heuristic finds the right buttons. The "Reset Consent" button wipes site storage and reloads so the CMP re-prompts.
04Does it support server-side tracking?
Yes. The Server-Side Tracking detector identifies first-party proxies and vendor server APIs by classifying every captured fire against canonical vendor hostnames, plus inline-script scans for known SST configuration patterns. Since v2.3 it also catches GA4 hits on renamed sGTM paths (e.g. /kpi/ instead of /g/collect) by their Measurement Protocol signature, and since v2.4 it decodes base64-encoded sGTM transports. Server-side fires appear with an SST badge and the actual proxy domain is surfaced. See the server-side tracking guide for the full list of signal sources.
05Can I save audits and compare them over time?
Yes. Saved Runs persists the full audit state — tags, events, cookies, consent, dataLayer log, server-side findings — under a name you choose. Load any saved run for a side-by-side diff with the current state: added tags, removed tags, fire-count deltas, and new violations are highlighted. Capped at 10 runs per browser.
06What does the tag latency badge actually measure?
Each captured fire is stamped with performance.now() at the moment of capture. The badge is rendered next to the time column: green < 500 ms, yellow 500–2000 ms, red > 2000 ms. It's the wall-clock time of the fire relative to navigation start — so a slow tag library or a CMP-gated load shows up immediately.
07Does Pixel Auditor slow down my browser or websites?
No. The content script intercepts JS calls without blocking the page. All original functions (fetch, XHR.open/send, Image, sendBeacon, gtag, fbq, uetq.push, clarity) are preserved and called through normally. There's no proxy, no polling loop, and no synchronous work on the hot path.
08Which browsers are supported?
Manifest V3 — works in Google Chrome, Brave, Arc, and any Chromium-based browser that supports the Side Panel API. Firefox is not supported (no Side Panel equivalent yet).
09What data does the extension collect?
None. All analysis is on-device. v2.0 self-hosts its fonts (Inter + JetBrains Mono bundled as WOFF2) so there are zero runtime requests to Google Fonts from the extension itself. Saved Runs and watch settings live in chrome.storage.local on your machine. There is no Pixel Auditor server to send data to.
10Does it work with Google Tag Manager?
Yes. Pixel Auditor intercepts dataLayer.push(), detects the GTM container ID, and tracks all fired tags routed through GTM. For server-side GTM specifically, the SST detector identifies first-party proxies and surfaces the actual proxy domain.
11Is it free? Are there any paid plans?
Pixel Auditor is completely free. No limits, no paid plans, no premium tier. Built to give marketers and developers a professional-grade tool at no cost.
12How do I report a bug or request a feature?
Reach out via the Contact page or the support email listed on the Chrome Web Store page. We respond within one business day on most messages.
Start auditing
pixels today.
Free. Private. Built for marketers and developers who care about getting tracking right the first time.