PXTA is the studio’s thirty-fourth project. The name is short for Pixel Tracking Audit. It loads a website in a real Chrome and visits every page three times: with the cookie banner left alone, after rejecting, and after accepting. Then it writes down what each tracker sent and when. There’s no score. Each finding is one sentence naming the page, the tracker and the data, with the request that carried it decoded underneath. The launch post walks through a report.
0.1.0 knows ten trackers, from the Meta Pixel and Google Analytics to TikTok, LinkedIn, Pinterest and X, and answers OneTrust, Cookiebot, Didomi and Usercentrics banners as well as plain ones it finds by their button words. It catches emails in a page address, hashed emails from automatic matching, site searches and health or money pages sent to ad networks, and Google Consent Mode reporting “granted” after a reject. The output is a self-contained HTML report, a JSON file and a HAR capture with its checksum, so the evidence can be filed. Four sample reports come from made-up businesses, among them a shop whose confirmation page leaks the customer’s email and a clinic whose ad pixels ignore the banner.
The testing runs real Chrome against fixture sites: fourteen banner setups done right and wrong, one email address in ten encodings, and a 500-page crawl with the browser killed after page 167. All 500 pages were recorded in that run. An independent review before release found that a page with an alert() could hang an audit, that a lone OK button could pass for a banner, and that some page names were wrongly flagged as sensitive. All of it was fixed and covered by new tests first. Like Watchkeeper, it looks at what websites do to their visitors, from the site owner’s side this time.
Open source under Apache 2.0, with releases for Linux, macOS and Windows.