Every Tracker We Have Found

You opened your browser tools, found a cookie called something like _gcl_au or __hstc, and searched for it. That is usually how people end up here.

This is the working list of everything our scanner currently recognizes: 32 services across 11 categories. Fourteen of them need notice and a working opt out, three depend on how the tool is set up or need a manual look, and the rest are the site doing its job. It grows whenever an audit turns up something the list did not already know.

The index

How to read it

Detected by request host only. Four rows carry that phrase instead of a cookie prefix. Those services set no cookie of their own, so the scanner spots them by the requests they make. A tag manager is the usual example. It still loads other things, and each of those is assessed on its own.

Consent tools appear in the list too. A cookie banner sets its own cookie to remember your answer, which is why Cookiebot, OneTrust and the rest show up here. That cookie is not a finding. It is the record of the choice.

Platform cookies are not trackers. Squarespace and Wix both set cookies simply to deliver the site, and neither of those is a finding. Both platforms also switch on their own analytics, which is why Squarespace Analytics and Wix Analytics each get a row of their own and a different answer in the last column.

The last column is not a banner column. Canada has no cookie banner law. Ordinary analytics can sit on the lighter path: tell people plainly what you collect, somewhere they can find it, and give them an opt out that actually takes effect. The strict path, where nothing fires until a visitor agrees, is what the advertising and profiling tools call for, along with session recording that captures typing and anything sensitive. If you have customers in Quebec, Law 25 pushes the profiling tools to off by default regardless of where you land federally.

One vendor can be several entries

HubSpot is the clearest example. It sets seventeen cookie prefixes across five completely different purposes, so it appears here as five separate rows. The analytics cookies tie an anonymous visit to a known contact record. The chat cookies recognize someone who has messaged you. The membership cookies keep a logged in user logged in. One records which version of a page a visitor was shown. And one records the visitor's own decision about being tracked at all. Treating those as one thing would be wrong in several directions at once.

Not on the list?

Then either it is not a tracker, or the scanner has not met it yet. Unrecognized third parties are never reported as a finding without a manual review, because an unknown is a question rather than a failure. If you have found something here that is not listed, send it over and it will end up on this page.

We are not lawyers and this is not legal advice. The last column is our reading of the Privacy Commissioner's guidance applied to what each tool actually does. For your own obligations, talk to a lawyer.