404 Site Audit · Visitor privacy & vendor analysis
Website Privacy Audit
Know what your website collects about the people who visit it. Trace browser fingerprinting, third-party vendors, and tracking requests—and give your team a clear plan to reduce unnecessary collection.
- 01Your website
A page loads. A visitor makes a consent choice.
- 02Scripts & vendors
Tags run, read browser signals, and load dependencies.
CanvasWebGLAudioFontsDevice signals - 03Requests & destinations
Trace what is sent, where it goes, and which script initiated it.
Does the observed behavior match what you intend?
Know what runs on your site
Your vendor stack is part of your visitors’ privacy.
Analytics, fraud prevention, advertising, embedded content, and support tools can each introduce browser-side data collection. A new tag or vendor update can change that behavior without a change to your own application code. The 404 Site Audit traces those integrations to the browser signals they access and the requests that follow, comparing their behavior with your consent setup and stated expectations. The findings give your team a practical basis for changing configurations, questioning a vendor, or explaining what happened.
Engineering & marketing
Inherited a tag manager or a growing vendor stack? Get a shared inventory of what runs, what it reads, and which team can change it.
Privacy & legal teams
Bring technical evidence to policy reviews, vendor questions, and customer commitments. Give counsel observed behavior to evaluate alongside contracts and disclosures.
Security & procurement
Review browser-side data collection as part of vendor oversight. Document owners, risk priorities, and the changes to check before the next release.
What we examine
From a browser signal to the vendor behind it.
Choose representative pages and journeys. We define the test conditions and depth of investigation around the decisions your organization needs to make.
Browser fingerprinting
Inspect canvas, WebGL, audio, font, and navigator or screen activity. Trace observed calls to the scripts responsible and examine how the signals are combined.
Evidence: API calls, script callers, and execution context.
Vendors and dependencies
Map the scripts and third-party services loaded during the agreed journeys, including tags introduced by other tags. Identify the purpose and owner of each integration with your team.
Evidence: script sources, initiating requests, and vendor inventory.
Data destinations
Examine outgoing requests and the browser data visible in them. Review first-party endpoints and DNS delegation for signs of CNAME-cloaked tracking where relevant.
Evidence: destination domains, request chains, and DNS records.
Consent and storage
Compare agreed states such as a fresh visit, refusal, acceptance, and withdrawal. Review cookies, browser storage, and vendor requests against your intended configuration.
Evidence: dated comparisons across the tested consent states.
Beyond GDPR & CCPA
Transparency starts with knowing what your site does.
GDPR and CCPA place transparency obligations on the organizations they cover. Explaining how you collect, use, and share personal information starts with understanding the scripts, vendors, and data flows actually present on your website.
These laws have different territorial scopes, coverage rules, and exemptions. Your privacy commitments can go further: protecting every visitor and reducing unnecessary collection even when a particular law does not apply.
Turn privacy promises into observable practices.
Use the findings to make disclosures more accurate, question unnecessary vendor access, and check whether visitor choices change what your site sends. Give your customers, partners, and privacy team evidence behind your commitments.
This is a technical website privacy assessment. It supports transparency and informed legal review; it is not a GDPR or CCPA compliance audit or certification.
Official guidance: GDPR principles ↗ · CCPA rights and coverage ↗ · ePrivacy technical scope ↗
What you receive
A vendor review your team can work from.
Get a dated assessment of the tested website, with findings tied to their supporting evidence. A shareable summary helps you explain the work to customers, counsel, or procurement.
- A vendor and destination inventoryObserved integrations, initiating scripts, data categories, and open questions for vendors.
- Findings with prioritiesEvidence, consent conditions, potential privacy impact, and recommended changes for each finding.
- An implementation handoffA prioritized action list for your team and a walkthrough of the report. Retest requirements can be agreed in scope.
- Observation
- Browser signals accessed by an embedded script.
- Context
- Page, timestamp, browser, and consent state.
- Evidence
- Script caller, relevant API activity, and associated requests where observed.
- Assessment
- Purpose, impact, priority, and confidence in the finding.
- Action
- Configuration change, removal, or a question for the vendor.
- Verification
- What to repeat after the change.
The engagement
Agree on the scope. Follow the evidence.
- 01
Define the visit
Agree on domains, representative pages, user journeys, consent states, browser setups, authorization, and the question the report needs to answer.
- 02
Collect & investigate
Run the agreed visits, preserve evidence, and examine scripts, browser signals, requests, and vendor relationships. Investigate findings in context.
- 03
Review & prioritize
Walk through the report with your team. Separate required integrations from unnecessary collection and assign practical remediation priorities.
- 04
Retest the changes
An agreed follow-up can repeat the relevant journeys and document what changed. Discuss periodic reviews as your site and vendors evolve.
See the instrument in public
Inspect the evidence behind the leaderboard.
Our public website scans show browser signal observations, script callers, and sanitized evidence records. The same scanning foundation supports this service; your engagement adds agreed journeys, vendor investigation, and recommendations for your own website.
Your review stays private.
Client reports are not automatically published. A paid engagement does not buy removal from the leaderboard; public corrections are handled on evidence.
A clear scan documents the tested conditions. It gives you a record to share, with dates and scope, rather than a permanent seal of approval.
Choose the right assessment
Your website or your team?
Your website → your visitors
Website Privacy Audit
What does your site collect, which vendors receive it, and how does the behavior change with consent?
The service on this pageYour staff → the sites they visit
Attribution Risk Audit
Which signals from your team’s browsers, devices, and workflows remain recognizable across sessions?
Explore Attribution Risk Audit →Before we begin
Website privacy audit FAQ
How is this different from a cookie scan?
Cookies are one part of the review. We also examine browser fingerprinting APIs, script callers, vendor requests, storage, and agreed consent journeys. The service includes human analysis, an explanation of each finding, and remediation priorities for your team.
Do you need access to our systems?
A public-site assessment starts from the outside, through a browser visiting your website. Administrative access is usually unnecessary. Authenticated journeys, staging environments, configuration review, or other internal access are agreed separately. We confirm your authorization and test boundaries before scanning.
Can this prove our website never profiles visitors?
The report documents what was observed on specified pages, dates, browser setups, and consent states. A clear result is useful evidence for that scope. It is not a certification or a guarantee about every visitor, future deployment, or server-side use of data. Retesting helps you document changes over time.
Can we use the report with counsel or procurement?
Yes. We can scope a shareable summary and a technical evidence package for engineering, privacy counsel, customers, or procurement. Legal interpretation and decisions about compliance remain with your counsel; this is a technical assessment, not legal advice.
What if our website is on the leaderboard?
You can request a private review or send a factual correction with supporting evidence. Purchasing an audit does not remove a public record or change its classification. Public findings are reviewed against evidence independently of paid engagements.
Will our audit results be published?
Client audit reports are private and are not automatically added to the leaderboard. Any public case study or publication of client findings requires agreement. The independent public leaderboard remains a separate research project.
Can you check again after we make changes?
Yes. We can scope a remediation retest and compare the same journeys before and after changes. Periodic reviews, including a quarterly cadence, can be discussed for websites whose vendors or releases change frequently. Retests, frequency, and deliverables are agreed in your proposal.
How much does a website privacy audit cost?
We agree on a quote before testing. Scope depends on the number of sites, pages and journeys, consent states, browser environments, and the depth of vendor analysis. Start with your public website address and the question you need answered; the initial scoping call is free.
Start with your website
What would you like to understand?
Send your public website address and the question that brought you here. Tell us whether you need a vendor inventory, a closer look at fingerprinting, a consent review, or help checking a change.
Book a free scoping call (opens Proton Calendar in a new tab)Free initial scoping call. We agree on the assessment and quote before work begins. Please leave credentials and confidential visitor data out of the form.
The inquiry form uses Cloudflare spam verification. See our privacy policy.