Pixel Auditor is a Chrome side-panel extension that inspects every tracking pixel firing on any web page — in real time. It catches PII leaks (and PII sent under denied consent), classifies Consent Mode states, reconciles conversions across platforms, surfaces server-side proxies and Google Tag Gateway, and grades the whole page A–F. All on-device. No account, no telemetry, no paid tier.
Pixel Auditor is a free Chrome extension that audits the tracking pixels on any website in real time. It opens as a side panel next to the page you are browsing and shows you, live, every analytics and advertising tag that fires — what platform it belongs to, what account ID it is tied to, when it fired, how long it took, what payload it carried, and whether that payload contains personally identifiable information or violates the page's declared consent state.
It exists because marketing analytics QA is still mostly done by squinting at the DevTools Network tab, and that is a poor use of an expert's time. Pixel Auditor replaces that workflow with a categorised, dedup'd, classified, severity-ranked feed — and ends with a single-file HTML report you can hand to a client.
It is not a SaaS. There is no Pixel Auditor server. The extension self-hosts its fonts,
makes zero outbound requests at runtime, and stores everything in
chrome.storage.local on your machine.
A condensed view. See the full feature list on the product site →
Hooks the JS layer at document_start, sniffs the network (fetch, XHR, image, beacon, form POST, plus a webRequest safety net), parses cookies, reads the DOM. Rescans on a 0 ms → 15 s ladder and on every SPA route change, so Next.js apps don't go dark.
Scans every fire's URL and payload — nested JSON bodies included — for raw emails, phone numbers, and 15+ named PII fields. Short-code values are heuristically validated to suppress false positives. Tiered raw / identifier / hashed.
Reads gcs= on every Google ping and classifies fires as denied-state modeling, plumbing, real violation, or inconsistent.
Injects Grant / Deny via gtag('consent','update'). One-click Accept / Reject auto-click across 19 CMP vendors.
Identifies sGTM (renamed paths, encoded transport, Stape), first-party proxies, and vendor server APIs by classifying captured fires against canonical hostnames. Surfaces the actual proxy domain — and tells Google Tag Gateway apart from a server-side container.
Every fire gets a green / yellow / red badge from performance.now(). The slow tag hanging your conversion is visible immediately.
Stream of every fire — platform, event, method, account ID, latency, severity. Substring or /regex/ filter across names, IDs, URLs and payloads — find a hit by transaction ID. Pause / resume.
100-point scale. Deductions for pre-consent fires, duplicates, retired tags, dormant IDs, missing IDs, missing required params, CSP-blocked tags, silent tags, and PII — steepest for PII sent under denied consent.
Persist the full audit state under a name. Load any saved run for a side-by-side diff with the current page. 10 runs per browser.
Single self-contained HTML file with every tag, event, score, consent transition, cookie, PII finding, and SST signal — opening with a plain-language page summary and compliance table. Send it. Sign it off.
Reads __tcfapi, __gpp, __uspapi, and Global Privacy Control. TCF v2.2 purpose grid plus a fire audit that flags tags firing against denied consent.
Decodes Google's gcd parameter on every hit — the consent state each hit actually carried, per signal, with default vs. user-update provenance.
Flags Meta browser events missing the server-dedup event ID when dedup is demonstrably in use — the fires at risk of double-counted conversions.
Export every captured fire as an RFC-4180 CSV, and compare any two Saved Runs for a side-by-side delta of tags, fires, PII, cookies, and SST signals.
Intercepts the hidden form POST carrying Meta's richest events (>2 KB payloads) and parses Shopify's undocumented trackShopify calls — closing the "Pixel Helper sees it, we don't" gap.
Flags tags that are installed but never fire — with a NO EVENTS badge and health deduction — and a webRequest safety net catches fires from sandboxed frames no JS hook can reach.
Every PII finding is correlated with the consent evidence that governed the fire — the hit's own gcd/gcs, then the IAB TCF record, then observed state. The GDPR-fine scenario as one PII · NO CONSENT finding, with the steepest health deduction.
One row per platform for the same checkout — conversions, sends, order ID, value, currency, dedup ID, user data. Flags duplicate conversions, order-ID disagreement, value or currency mismatch, and missing dedup IDs.
Is user-provided data captured and sent? Reads Google's tv.1~ wrapper and UET's pid on the wire and the capture calls in JS. Verdicts: sent · captured but not sent · configured with no data · not detected.
Decodes the IAB euconsent-v2 string offline when a CMP exposes no working __tcfapi — paste any TC string to read it — and reports Google Tag Gateway as what it is: a first-party delivery path to Google, not a server-side container.
One click. No account, no card. Pixel Auditor runs entirely on your machine.
Click the toolbar icon. The side panel docks beside the page and starts scanning.
Tags, events, consent, PII, SST, A–F grade — real-time, zero impact on the page. Save the run or hit Export when done.
Verify every conversion fires once, with the right value, after consent. Catch PII leaks before legal does. Hand over clean reports.
Inspect dataLayer pushes, intercept gtag/fbq calls, see network payloads — without console.log scaffolding.
Audit any client site in 30 seconds. Send a branded HTML report. Compare pre- and post-launch with Saved Runs. Bill for the diagnosis.
There is no paid plan. There is no usage limit. There is no Pixel Auditor account. The extension is published by Ratan Jha Digital on the Chrome Web Store and that's the whole story.
Install from Chrome Web StoreMore detail lives on the main product site, and every release is listed in the version history.
Pixel Auditor is a free Chrome side-panel extension that detects, validates, and audits every tracking pixel firing on any web page in real time. It covers Google Analytics 4, Google Ads, Google Tag Manager, Meta Pixel, LinkedIn Insight Tag, Microsoft Bing UET, Microsoft Clarity, TikTok, Pinterest, Snap, Reddit, Segment, Tealium, Hotjar, Criteo, Klaviyo, X Pixel, Amazon Ads Tag, Floodlight, HubSpot, Adobe Experience Platform — 24 tag types — and any server-side proxy, Google Tag Gateway, or vendor API. It catches PII leaks (including personal data sent under denied consent), classifies Consent Mode and IAB TCF state, reconciles conversions across platforms, and grades the page A–F. All analysis is on-device.
Yes. No paid tier, no usage limits, no account required, no credit card. Published free on the Chrome Web Store by Ratan Jha Digital.
It scans every captured fire's URL and parsed payload — nested JSON bodies, bracket keys like ud[em], and JSON encoded inside a parameter value included — for raw emails, phone numbers, and 15+ named PII fields (email, phone, first_name, last_name, dob, ssn, zip, address, etc.). Short-code parameters (em, ph, fn, ln) are validated heuristically — the value has to look like PII before it's flagged. Since v2.6 every finding is correlated with the consent state that governed the fire, so personal data sent under denied consent is flagged as PII · NO CONSENT.
Yes. Pixel Auditor reads the gcs= parameter on every Google ping and classifies fires as denied-state modeling, plumbing, real violation, or inconsistent — and since v2.5 it decodes the gcd parameter too, showing the per-signal consent state each hit actually carried. The Consent Mode Simulator injects Grant / Deny and shows a 5-second diff of what re-fires. One-click Accept / Reject auto-click works across 19 CMP vendors including OneTrust, Cookiebot, Didomi, TrustArc, Usercentrics, and Sourcepoint. v2.4 added IAB TCF v2.2, GPP, US Privacy, and Global Privacy Control auditing, and v2.6 decodes the TC string offline when a CMP exposes no working __tcfapi.
Yes. The SST detector classifies captured fires against canonical vendor hostnames, scans inline scripts, hooks runtime calls, and inspects the dataLayer. Server-side fires get an SST badge and the actual proxy domain is surfaced. Converging signals are confidence-fused. Renamed sGTM paths and base64-encoded transports are caught, and since v2.6 Google Tag Gateway is reported as what it is — a first-party delivery path to Google — rather than mistaken for a server-side container.
No. Original functions (fetch, XHR, Image, sendBeacon, gtag, fbq, uetq.push, clarity) are preserved and called through. No proxy, no polling, no synchronous work on the hot path. The extension self-hosts its fonts and makes zero outbound requests at runtime.
Manifest V3, Side Panel API. Works in Google Chrome, Brave, Arc, and Microsoft Edge. Firefox is not currently supported.
Pixel Auditor is built and maintained by Ratan Jha Digital. Bug reports, feature requests, or partnership questions: write@ratanjha.com.
Free. Private. Built for the people who care about getting tracking right the first time.