[invisit](https://invisit.dev) · [Docs](https://invisit.dev/docs) · [llms.txt](https://invisit.dev/llms.txt) · [llms-full.txt](https://invisit.dev/llms-full.txt)

# Tracker detector

> Enter a page and see the analytics, ad pixels, session replay, consent banners, chat widgets and other third parties it loads, with the evidence for each and the tags inside its Google Tag Manager container.

- Run it: https://invisit.dev/tools/tracker-detector (free, no account)
- Last changed: 2026-11-05

## What it looks at

Everything a page sends before it runs, plus the parts it names:

- **The HTML:** script tags, inline code, preloads and preconnects, images and pixels, iframes, and the `<noscript>` fallbacks where ad pixels like to hide.
- **The first response’s cookies**, by name and settings. Values are never read.
- **Up to six script bundles**, the page’s own app bundles first, since analytics SDKs are often bundled in rather than loaded from a vendor.
- **Google Tag Manager.** A container is a public file, and its tags are listed in it as plain data. When a page names a container, we read it and list what it can fire: GA4, Google Ads conversions, Floodlight, the Meta Pixel in a Custom HTML tag, and so on, with how many of its tags wait for consent.

Each vendor comes with the evidence that matched: the script address, the snippet, the cookie or the Tag Manager tag. If something looks wrong, the evidence shows why we think so.

## What it can’t see

Tags that only load after consent, after a click, or from code that decides at runtime what to load. Server-side tagging, where the browser sends one request to your own domain and your server fans it out to vendors. And anything behind a login. A browser’s network panel shows those; this scan shows what is visible from outside.

## Fewer third parties

Every host in the list sees your visitors’ IP addresses and the page they’re on. Most sites carry a few they no longer use: a retired Universal Analytics tag, a Google Optimize snippet from before it shut down in 2023, a pixel from a campaign that ended. Removing those is free speed and less to disclose in your privacy policy.

If analytics is what you need, invisit is one script with no cookies and no device identifiers: page views, sources, events, funnels and Web Vitals. See [how it counts without cookies](https://invisit.dev/docs/guides/privacy.md) and [the install guide](https://invisit.dev/docs/web/installation.md).

## Common questions

### Why does it miss a tracker I know the site uses?

Most likely the tag loads later: after someone accepts cookies, from code that runs once the app starts, or from a tag manager we can’t read, like a server-side container. This is a static scan of what the page sends, so it sees what is written into the page and its Google Tag Manager container, not everything a browser ends up loading.

### Does a vendor listed here mean data is being collected?

It means the page loads that vendor’s code, pixel or frame, or names it in a Tag Manager tag. A tag can still be held back by consent or by its triggers. The evidence under each vendor says exactly what was found and where.

### What does “Sets cookies” mean?

That the vendor’s own documentation says it sets cookies by default. Cookieless means it documents that it doesn’t. When we haven’t found it written down, we say neither.

### Is it fine that the report shows my GA4 and pixel IDs?

Yes. Those IDs are sent to every visitor’s browser, so anyone can read them from the page source. They identify an account; they don’t give access to it.

### Where does the list of vendors come from?

We wrote it ourselves from each vendor’s install docs and published snippets: over 400 vendors, from GA4 and the Meta Pixel to consent managers and chat widgets. It isn’t copied from other tracker lists.