Personal data categories in requests
The check reads request addresses and payloads sent to vendors and reports the categories it finds, such as email. It does not store the values.
Free tool · Personal data tracking checker
Personal data tracking checker
Ad and analytics tags sometimes send personal details inside page addresses or request data. This check looks for categories, such as an email field, and never stores the values. It is built with healthcare and banking sites in mind, but any site can run it.
What this checks
What the check looks at on one homepage load.
Each item is something the scan records from the browser or reads from your published Tag Manager container.
Which vendors received them
Each finding names the vendors that received the data, so you can check their terms and your agreements with them.
Data sent before a choice
It also notes ad data and ad cookies sent before a visitor answered the banner, and tracking that continued after Reject.
What the homepage cannot show
The homepage rarely has forms, so form fields are seldom seen. A clean result says nothing about your forms.
What the results mean
How to read a result.
Each result says what the check saw. Some are information, and some are gaps to fix. The gaps from this check are listed first, then any other gaps the scan found.
Personal details observed in requests to vendors
Categories of personal data appeared in what a vendor received. The category is shown, never the value. Review that tag first.
Ad data sent before a choice
Ad data went to a vendor before the visitor chose. Check whether the banner is meant to hold that tag back.
Tracking still runs after a visitor clicks Reject
Vendor requests continued after Reject, so data may still be sent after a refusal.
No personal details observed
The homepage load showed no personal data categories. This does not cover your forms, logged-in pages, or booking flows.
How to fix it
Common fixes for what this check reports.
Each one is a change to your site or your tag setup. Your team decides how to make it.
Keep identifiers out of page addresses
Page addresses and page titles can carry names, conditions, or account details. Remove those from what tags send, or send a generic page name instead.
Map what each tag receives
For every ad and analytics tag, write down what data it sends and where. Remove any element nobody needs.
Do not rely on vendor promises alone
A vendor saying it strips personal data after receiving it is not enough. Check what leaves your site before it leaves.
Involve your compliance team early
Ask your compliance or legal team which agreements and permissions your data flows need. For healthcare, Google says it does not offer a business associate agreement for Google Analytics.
Limits
What this check can’t see.
The limits of one homepage load, so you can read the result correctly.
- One homepage load on desktop. It rarely reaches forms, booking pages, patient portals, or account pages.
- It reads categories in requests. It cannot tell with certainty whether a value is personal, and it does not keep values to check.
- It does not see server-side data, offline data, or data sent from your CRM.
- A consent banner can hold tags back. An empty result may mean the tags were held, not that none exist.
- It is not a legal review, and it does not decide whether any data flow is allowed.
Read more
Guides on the setup this check covers.
Background reading for the same setup, with the steps behind each fix.
Other free checkers
Check the rest of your tracking.
The other free checks run the same scan and list the gaps for their own topic first.
Consent Mode v2 checker
Consent Mode tells Google tags what a visitor agreed to. This check reads the consent signals your homepage sends and flags setups that leave out the v2 settings or set the default too late.
Cookie consent checker
Many sites load ad and analytics tags as soon as the page opens. This check loads your homepage once and records what fires before any choice is made on the banner.
Cookie banner reject test
A Reject button should stop optional tracking. This check clicks Reject on your homepage in a separate pass and records what keeps running afterwards.
Meta Pixel checker
A Meta Pixel that loads twice, or sends the same page view twice, can inflate the numbers Meta reports. This check counts what your homepage sends to Meta and shows where the Pixel is set up more than once.
Google Ads conversion checker
A Google Ads conversion only counts if a tag sends it to Ads. This check reads how your conversions are set up in your published Tag Manager container and whether they are sent to Google Ads.
GA4 checker
This check looks at what your homepage sends to Google Analytics 4. It flags setups with more than one property, retired Universal Analytics tags, and repeated page views.
Google Tag Manager checker
This check reads the published Tag Manager container your homepage loads. It looks at how the container is set up, not only at what reaches the browser.
Lead form attribution checker
When a visitor clicks an ad and fills in a form, the campaign details have to survive the trip. This check follows links to your lead pages and looks for the fields that carry them.
FAQ
Personal data tracking: common questions.
Answers to the questions we hear most about this check.
Is this checker free?
Yes. Enter your website and the scan loads your live site and reports what it finds. You see the verdict and how many gaps it found right away; enter a work email to see each gap and what it means.
Does the check store the personal data it finds?
No. It records the category, such as email, and the vendor that received it. It never keeps the value.
Is a cookie banner enough for HIPAA?
No. HHS states that a banner asking visitors to accept or reject tracking is not a HIPAA authorization. Talk to your compliance team about what applies to you.
Can a healthcare site use Google Analytics?
Google says it does not offer a business associate agreement for Google Analytics, and that HIPAA-regulated entities must not expose protected health information to it. Talk to your compliance team about what that means for your site.
What did the court case change?
In AHA v. Becerra (June 2024), a federal court vacated only the part of the HHS tracking bulletin about IP addresses on unauthenticated pages. The rest of HIPAA still applies.
Free Tracking Scan
Find your tracking gaps in about 10 seconds.
Enter your website and we check your live site, then list every gap we find, starting with this check’s. No call needed.