Server-side tracking detection

Server-side tracking moves the request from the browser to your own server (or a SaaS proxy), then forwards to the vendor. From a regulator's point of view, the data still leaves the user's device — but from a browser extension's point of view, the request goes to a host you control, not to google-analytics.com or facebook.com.

v2.0 detects this through four independent signal sources, then fuses converging signals into a single high-confidence finding.

Signal source 1 — script-text scan

Inline <script> contents are scanned for proven SST configuration patterns:

• transport_url in a gtag config call (Google sGTM)
• server_container_url set on a GTM dataLayer push (Google sGTM)
• Custom GTM loader pointing at a non-Google host
• Meta fbq with explicit eventID + agent (CAPI Gateway)
• Vendor server-API SDK calls carrying event_id / test_event_code / client_dedup_id patterns
• Edge-tag platform globals and brand-owned subdomain script sources

Signal source 2 — runtime state inspection

Walks window.dataLayer Arguments entries for config / set calls with transport_url or server_container_url. Probes window.google_tag_manager[id].dataLayer.get('server_container_url') which GTM exposes when a server container is live. Adds a soft Meta-CAPI signal when both _fbp and _fbc cookies are set and fbq is active.

Signal source 3 — runtime hooks

The live dataLayer and gtag() hooks check every runtime call for SST-relevant params and add findings in-flight, even when the configuration was set after page load.

Signal source 4 — network classification

Every captured fire is run through classifyFireAsSST(url). If the URL path is a known tracker endpoint but the host is NOT that vendor's canonical host, a high-confidence finding is emitted. The path checks are anchored at the start of the pathname, and each vendor check requires a vendor-specific parameter signature:

Confidence fusion

Findings are grouped by platform at render time. A platform with two or more independent signals is shown with high confidence + a "(N converging signals)" note, regardless of the individual signals' strengths.

When the detector runs

• At T+5 s (initial scan)
• Re-runs at T+15 s — catches CMP-gated setups not present at T+5s
• Re-runs after every consent update that lands
• Network classification runs on every fire

Where findings appear

• Tags tab — affected tag cards get an SST badge and the actual proxy domain
• Audit tab — dedicated "Server-side findings" section with confidence and signal breakdown
• Audit report export — full SST section with all signals listed