Pixel Auditor/Help/What's new in 2.5

What's new in 2.5

The 2.3 → 2.5.4 changelog, condensed to what users actually care about. For the full release-by-release list, see the version history.

v2.5 is the cumulative set of releases since 2.0 — three feature waves (2.3, 2.4, 2.5) focused on deeper Google-stack coverage, the IAB privacy frameworks, five new vendor platforms, and client-ready reporting. The 2.5.1–2.5.4 updates that followed close the last big capture gaps: Meta's form-POST transport, Shopify's trackShopify events, and tags that are installed but never fire.

2.5.4 — Meta transport capture & silent-tag auditing (August 2026)

Meta form-POST transport capture

Meta's fbevents.js only sends a hit as a GET image while the URL stays under 2,048 characters. Advanced Matching, cd[contents] arrays, and CAPI event IDs routinely push ViewContent and Purchase payloads past 2 KB — at which point Meta switches to a hidden <form method=post> submission that no fetch/XHR/img/beacon hook ever sees. That's why on payload-heavy sites Meta's own Pixel Helper showed events while other inspectors showed none. Pixel Auditor now intercepts the form submission itself (plus Meta's FormData sendBeacon path), so the richest Meta events are captured. An early fbq trap also catches inline fbq('track','PageView') calls from the moment the page assigns the stub, and Meta rows now always show their real event name — no more tr labels.

Shopify trackShopify support

Shopify's official Facebook & Instagram sales channel routes all Meta events through an undocumented fbq('trackShopify', pixelId, eventName, params, {eventID}, customData) action. Previously those fires were dropped entirely — the pixel showed as initialized and permanently silent. Now they're fully parsed, including the CAPI dedup eventID, which makes the Meta CAPI dedup audit work on Shopify stores for the first time.

"Installed but not firing" is now a finding

A tag whose library loaded, whose pixel ID was read out of its own state, and which then sends nothing at all is a defect you're paying for and not getting — and it used to be invisible, because the evidence is an absence. The new silent-tag audit names each dead tag in the Audit tab, adds an outlined red NO EVENTS badge in the Tags list, applies a health deduction, and mentions the dead tags in the client-facing page summary. It's deliberately conservative: an extracted ID is required, GTM containers are excluded, and a 10-second grace period runs from first detection.

webRequest safety net

Content scripts can't reach every frame (opaque-origin sandboxes, ad frames), and some transports never touch a patched API. A new observational webRequest layer in the service worker catches those fires — strictly as a safety net: it stands down whenever an equivalent page-sourced fire (which carries richer context) arrived first, so nothing double-counts. Both content scripts now also reach about:blank and srcdoc frames.

Image-beacon interception completed

The old <img> hook only saw new Image(). Pixels sent via document.createElement('img'), setAttribute('src', …), or markup injection were invisible. All three paths are now intercepted at the prototype level and funnel through a single dedup'd reporter.

Export redaction & PII severity tiers

A new "Redact PII in exports" toggle (default ON) scrubs the JSON, CSV, and HTML files that actually leave your machine, and saved runs no longer retain raw PII values in long-lived storage. The PII detector also got calibrated: MD5 and base64 digests are recognised as hashes (so correctly-hashed matching no longer reads as a raw leak), country_code is no longer flagged, and pseudonymous cross-site identifiers (external_id, customer_id) get their own medium-severity tier with value-aware promotion and demotion.

Scoring that tells the truth

The 2.5.3 correctness patch made several findings finally count: event validation now runs once per fire at ingest (so the missing-params deduction, the report's missing: badge, and the CSV column actually work — GA4 network hits included), PII leaks deduct from the health score, and a page whose tag libraries were all blocked by CSP can no longer score 100. Expect grades to drop on sites with incomplete GA4 ecommerce — that's the deduction working for the first time, not a new penalty.

Stability fixes

  • Back/forward navigation no longer blanks the panel — tags repopulate within ~1.5 s after a bfcache restore.
  • Cold-start state resurrection fixed — the service worker could re-insert the previous page's tags over a fresh navigation and persist the corruption.
  • Google Ads dedup completed — one remarketing action no longer renders as two rows, in any beacon order.
  • Cross-site comparisons warned — run compare and snapshot diff refuse to silently compare two different sites.

2.5 — Consent ground truth & dedup auditing (July 2026)

Per-hit consent decoding (gcd)

The gcd parameter on every Google hit is now decoded per hit. Unlike the consent timeline (what the CMP said), this is ground truth — the consent state each hit actually carried: ad_storage, analytics_storage, ad_user_data, and ad_personalization, each with default vs. user-update provenance. The event drawer shows a "Consent on this hit" card with granted / denied / not-set pills, and warns when Consent Mode isn't active at all — meaning Google received the hit unrestricted. → Consent Mode classifier

Meta CAPI dedup audit

Meta deduplicates browser + Conversions API events only when the browser event carries an event ID (eid on /tr hits, eventID on fbq() calls). If any Meta fire on the page carries one — proving dedup is in use — every Meta fire without one is flagged: those risk being double-counted as inflated conversions. Yellow NO DEDUP ID badge in Live Events, a warning card with the fix in the drawer, and a "Meta CAPI Dedup" section in the Audit tab.

Plain-language Page Summary

A new section at the top of the Audit tab — the paragraph a non-technical client reads first: detected stack (IDs, GTM, CMS), fire counts, consent posture, pre-consent fires, PII, server-side tracking, CSP-blocked requests, and the health grade. The HTML report opens with the identical paragraph.

CSP-blocked fires — scoring & reporting

Fires blocked by the site's Content Security Policy (detected since 2.4.9) now deduct from the health score with a reason line, get a red CSP BLOCKED badge in the HTML report, a "CSP-Blocked Tracking" endpoint table, and their own CSV column.

2.4 — New vendors, IAB frameworks, reporting (June–July 2026)

Five new platforms

Segment, Tealium, Hotjar, Criteo, and Klaviyo are now detected — each with ID extraction (write key, account/profile/env, hjid, account, company id), tracking-cookie attribution, a Live Events filter chip, and pre-consent flagging. → Supported platforms

IAB privacy frameworks — TCF v2.2 / GPP / US Privacy / GPC

Pixel Auditor now reads the IAB consent layer alongside Google Consent Mode: the __tcfapi (TCF v2.2 purposes, vendor consents, gdprApplies), __gpp, and __uspapi CMP APIs, plus navigator.globalPrivacyControl. The Audit tab gains a "Privacy Frameworks" section with a GPC pill, an 11-purpose TCF consent grid, GPP sections, US Privacy opt-out — and a fire audit listing tags that fired against denied TCF consent.

Reporting & cross-run compare

  • CSV export of captured fires from the Live Events toolbar (RFC-4180).
  • Compliance summary at the top of the HTML report: consent pass-rate, pre-consent fires, PII leaks, SST signals, and a framework table.
  • Cross-run compare in Saved Runs: pick a baseline and a comparison run for a side-by-side delta — stats, added/removed/changed tags, cookie changes. → Saved Runs

Quality-of-life

  • Encoded sGTM transport — base64-encoded server-side GA4 payloads are now decoded and attributed (live-tested against a Stape loader).
  • Plain-language event summary in the drawer — one consolidated card explaining what the event is and what it carried.
  • Conversion Linker muting — Google Ads setup pings can be hidden with a toggle so conversion counts read clean.
  • Google Ads dedup fix — distinct events at the same endpoint no longer collapse into one.

2.3 — Unified gtag.js coverage & security hardening (May–June 2026)

  • Google Ads and Merchant Center via the unified gtag flow are now caught — ID-driven detection, modern endpoints (/ccm/collect, /pagead/1p-conversion, td/rul), batched-fire fan-out, and Arguments-object dataLayer pushes.
  • Renamed-path sGTM detection — GA4 hits on arbitrary first-party paths (e.g. /kpi/ instead of /g/collect) are caught by their Measurement Protocol v2 signature, independent of host and path.
  • Modern GA4 packed item format (pr1=idSKU~nmFoo~…) parsed — ecommerce items render in the drawer.
  • Security hardening — cross-tab state reads locked to the side panel, an authenticated command channel between bridge and page agent, and PII redacted from Saved Runs at the persistence boundary.

Looking back — what 2.0 added (April 2026)

v2.0 was the first public update since 1.0.0 and laid the foundation the releases above build on.

New detection capabilities

PII Leak Detector

Scans every captured fire's URL and parsed payload for raw emails, phone numbers, and 15+ named PII fields. Short-code parameters are heuristically validated — the value has to actually look like PII before flagging. Per-platform confidence tiering. → PII Leak Detector

Consent Mode classifier

Replaces the old binary "preConsent" flag with a tiered classifier that reads the gcs= param Google stamps on every Consent Mode v2 ping. Distinguishes denied-state modeling, plumbing events like cookie_consent_update, real non-Google violations, and inconsistent fires. → Consent Mode classifier

Server-Side Tracking detector — full rebuild

Multi-source: inline script-text scan + live dataLayer / window.google_tag_manager inspection + runtime hooks on dataLayer.push and gtag() + network classification of every captured fire against canonical vendor hostnames. Covers first-party proxies for Google and Meta, vendor server APIs with event-id patterns, and major edge-tag platforms. Confidence-fusion groups multiple independent signals on one platform into "converging" findings. → SST detection

Tag latency badge

Every fire is stamped with performance.now() at capture and rendered as a tinted badge: green <500 ms, yellow 500–2000 ms, red >2000 ms. → Tag latency

New tooling

Consent Mode Simulator

Inject Grant or Deny via gtag('consent','update',…) and watch the 5-second diff of what actually re-fires. "Accept via CMP" / "Reject via CMP" auto-clicks supported across 19 vendors: OneTrust, Cookiebot, CookieYes, Complianz, Klaro, Didomi, Quantcast, TrustArc, Osano, Usercentrics, CookieLawInfo, Iubenda, Sourcepoint, Termly, Ketch, Axeptio, tarteaucitron, WP-GDPR (WPEka), Secure Privacy. Generic text-based heuristic for custom banners. "Reset Consent" wipes site storage and reloads. → Simulator

Saved Runs

Persist the full audit state — tags, events, cookies, consent, dataLayer, SST findings — under a name you choose. Load any saved run for a side-by-side diff. Capped at 10 per browser. → Saved Runs

Multi-watch, per-site scoped

Watches now attach to the current site by default. An "apply to all sites" toggle in the Add Watch modal makes them global. Cross-tab notification firing — matches trigger alerts regardless of which tab the panel is focused on. → Watch for Event

Event search + regex filter

Plain text matches across platform / event name / method / account ID / URL. Wrap in /…/flags for a JS regex literal. → Search & regex

Pause / Resume recording

DevTools-style toggle in the Live Events action bar. → Pause / Resume

Interface and visuals

  • Light + Dark themes with manual toggle. Zinc-warm dark base with violet accent; paper-tone light with deeper borders. System-preference awareness, explicit user override persisted.
  • SVG icon system. All UI emojis replaced with an inline SVG registry (27 icons). Themes via currentColor.
  • Platform icons redrawn. Brand-inspired abstract marks, explicitly not trademark logos.
  • Self-hosted fonts. Inter and JetBrains Mono bundled as WOFF2. Zero runtime requests to Google Fonts from the extension.
  • Drawer redesign. Resizable via top drag grip, double-click to toggle 45% / 90%, framed × close button.
  • Event row improvements. Left-bar severity indicators replace full-row tints. New NEW badge for snapshot diff, violet eye badge for watched events.

Under the hood

  • XSS hardening across the rendering pipeline. All inline interpolations wrapped in escapeHtml() or safeColor(); dynamic platform colors validated against a strict hex regex.
  • Message-bus validation. The isolated-world bridge validates message types against a whitelist before relaying to the service worker.
  • Per-tab memory cap on the service worker's event store (2000 entries per tab).
  • Three-layer dedup chain with rapid-fire heuristic. → Duplicate detection
  • MV3 compliance audit. Explicit content_security_policy, all permissions reviewed against actual API usage, dead code removed. ~427 KB bundle.

Migration notes

  • Watch list: tpc_watched_event (single string) and tpc_watched_events (flat array) both migrate automatically to the new { global, byDomain } shape on first open.
  • No other storage schemas changed.
  • No breaking API changes from a user's perspective.