What the Tracking Check tests

The check recognises eleven common consent platforms by their SDK, not by the visible banner. No CMP while cookie tags load is critical.

The deep scan clicks "accept" and waits for the first measurement ping. If none comes, every consent you are given is lost, and nobody notices.

The check looks for the gtag(consent) call with the four V2 parameters. If it is not in the HTML, the deep scan watches in the browser whether a CMP sets it.

Advanced keeps sending cookieless pings with the gcs parameter after rejection, basic sends no Google measurement at all. The deep scan reads the mode off the reject state.

The deep scan clicks "accept" and waits for gtag('consent', 'update'). Without the call the Google signals stay on denied, even for visitors who agreed.

The check looks for the __tcfapi and __gpp interfaces in the HTML. Without programmatic advertising the note is expected; with it, it is a finding.

The check lists script, pixel and iframe sources from advertising and tracking vendors that set third-party cookies on your page. Safari and Firefox have blocked them for years.

The scanner reads the publicly served Borlabs config and decodes its opt-in codes: container IDs and custom loaders that only load after consent become visible, no click needed.

When the Google Tag Manager service sits in a CMP group like "external media", visitors who consented to statistics are never measured. The check reads the mapping from the Borlabs config.

The deep scan opens the page in a browser, clicks "accept" once and "reject" once, and compares requests and cookies. This line says whether that worked.

The check reads the Set-Cookie header of the first response, before any script runs and before anyone clicks. Every cookie in it is "to review", not automatically a violation.

Trackers referenced before consent only become a violation once they execute. The check lists the references; whether CMP blocking or Consent Mode stops execution is what the deep scan shows.

The scanner locates the privacy policy link, fetches the page and reads it as the source for matching the policy text against the detected tracking stack.

The scanner holds the visible text of the privacy policy against the detected tracking stack and lists every tool in use that the policy never mentions.

The deep scan clicks "reject" and reads the network log. Every marketing or analytics request and every non-essential cookie after that is critical.

The check detects Google Ads conversion IDs, the conversion linker and enhanced conversions in gtag and GTM. Without both, Google Ads only attributes part of your conversions.

The check looks for traces of server-to-server conversion APIs in the HTML. It only sees what the browser gives away; a server container leaves none.

The dataLayer is the interface between website and tag manager. Without it, or with an empty one, tags hang on CSS selectors and break with the next redesign.

Two GA4 properties or two GTM containers on the same page double-count pageviews. The check lists every ID it finds, including dead UA leftovers, and the deep scan counts the page_view pings per property.

The check looks for your own tagging endpoint in the source: a stape loader, gtm.js from your own domain, or measurement paths on a subdomain. The deep scan confirms in the browser where the pings go.

The deep scan reads from the request log whether measurement pings run through a first-party endpoint or go straight to Google: client-side, hybrid or server-side.

The check looks for twelve measurement tools in the executable part of the HTML, from GA4 to Plausible. No match is critical, unless a server-side endpoint takes over.

The check looks for five tag management systems in the HTML. Finding none is a note, not an error; a container in first-party mode can trigger it.

GA4 drops revenue without a currency, and mixed currencies make totals unusable. The check tests the currency in JSON-LD, dataLayer and DOM.

The check compares the visible price on real product pages with JSON-LD Offer.price and the dataLayer. Deviations distort ROAS and revenue reports.

Without Product JSON-LD carrying an Offer price, search price snippets disappear and AI search cannot cite product data. The check tests real product pages.

On detected shops the deep scan checks up to five real product pages: visible price, JSON-LD, dataLayer and view_item, compared directly.

Without view_item on product pages, GA4 e-commerce reports stay empty and remarketing lists never fill. The check tests the event on real product pages.

Google largely wound down the Privacy Sandbox in 2025, several ad APIs are being retired. This check is an inventory signal, not a recommendation.

Third-party scripts loaded synchronously in the head hold up first paint; every second of load time measurably costs conversions.

The check counts script tags from foreign domains in the delivered HTML and flags five privacy-relevant embeds. From 11 "to review", from 21 critical.

The check downloads up to six known tracking scripts itself and sums their size. Over 100 KB is "to review", over 200 KB critical.

The check reads robots.txt for rules on seven AI crawlers. It does not judge, it shows: blocked, allowed, or no decision at all.

The check reads three headers of the scanned page: HSTS, X-Frame-Options or frame-ancestors, and a Content Security Policy. One missing means "to review".

The check looks at whether the page is served over HTTPS after all redirects. No is critical, because then the tracking requests travel in plain text too.

The check parses the JSON-LD blocks in the source and lists the schema.org types. Structured data is not a ranking factor, but the ticket to rich results and unambiguous entities in AI answers.

llms.txt is a Markdown index of your key content for LLM tools (llmstxt.org), not a permissions file; which crawlers read it remains open.

The check reads three tags from the HTML of the scanned URL. One missing means "to review"; it does not rate length, duplicates or og:image.

The check fetches robots.txt and reads the group for all crawlers. Unreachable or a blanket Disallow is "to review".