What Your Website Tracking Actually Collects

Most business owners have never seen what their own website collects. They set up Google Analytics once, maybe added a Meta pixel for ads, and moved on. Meanwhile, every single visitor is being measured. Here is what that actually means, without the jargon.

It starts before the first click

The important thing to understand is the timing. A lot of this collection happens the instant the page loads, before the visitor has clicked anything, agreed to anything, or even finished reading your headline. The tools fire on load. That is the default, and it is the root of most privacy gaps.

What a normal setup gathers

• A persistent identifier. Analytics drops a value in the visitor's browser that recognizes them across pages and across visits. It does not need a name to follow a person.
• Behaviour. Which pages they saw, in what order, how long they stayed, what they clicked, where they came from.
• Device and rough location. Browser, device type, and a general sense of where in the world they are.
• For advertising pixels, a copy of some of that behaviour sent off to the ad platform so it can match the visitor to a profile it already holds.

Functional versus tracking

Not every cookie is a privacy problem, and this is the distinction that matters most. A functional cookie is the plumbing. It remembers what is in a cart, keeps someone logged in, holds their language choice. It is doing a job the visitor actually wants, and it is generally fine. A tracking identifier is different. Its job is to recognize and follow a person for measurement or advertising, and that is the kind of data that privacy law cares about.

Why this matters

Once you can see that your site is collecting persistent identifiers and shipping behaviour to third parties before anyone was told, the privacy rules stop feeling abstract. That collection is the thing the law is about. It is worth saying what the law then asks, because it is more moderate than most people expect. Canada has no cookie banner rule, and for non sensitive tracking PIPEDAPersonal Information Protection and Electronic Documents Act, Canada's federal privacy law allows consent to be implied, so long as the notice comes at or before collection, the purpose is in plain language, and opting out is easy and actually works. Where the tracking profiles someone in a way they would not expect, or records what they type, express consent is the standard instead. The good news is that seeing what runs on your site clearly is most of the battle.

If you have never actually looked at what your own site collects, that is worth doing, and it is the first thing we inventory on the privacy and tracking side of an audit.