How the scan works
PixelXray opens your store in a real Chrome browser, the way a shopper would, and records every request the page and its scripts send. It then works out which tracking platforms received which events. We never log in, never enter personal data, and never buy anything.
The visit
- Homepage. We load the homepage and record what fires before anyone answers the cookie banner.
- Cookie banner. Each scan makes two separate visits in fresh browser sessions: one where we accept cookies and one where we reject them. We read the banner's stored choice and Shopify's consent state back to confirm the click worked.
- Product page. We open one product, picked from the homepage or the store's public product list.
- Cart and checkout start (full scans only). When the person starting the scan confirms they own the store or have permission, we add one product to the cart and open the first checkout page, then stop. Nothing is submitted.
Scans without the full journey are labelled partial (homepage and product pages only), and their grade only covers those pages.
Where we scan from
Scans run from a server in the EU. Stores often show different banners and tags to different regions, so results describe what an EU visitor experiences.
Our browser's user agent
We use the normal desktop Chrome user agent with a short tag appended:PixelXray/0.1 (+https://pixelxray.com/methodology). Headless and bot user agents can change which tags load, so we look like a regular browser, while the tag lets store owners identify our visits in their logs. In our tests the tag did not change which tracking fired.
What a scan cannot see
- Events a server sends to ad platforms (Conversions APIs). We only see hints of them, such as first-party endpoints or installed apps.
- Purchases: we never complete an order.
- Events some platforms send only for known visitors, for example after an email sign-up.
- Store settings inside Shopify or the ad platforms.
Every report lists what that particular scan could not check.
How the score works
The score is out of 100 and is the weighted mean of four categories:
| Category | Weight | What it covers |
|---|---|---|
| Event coverage | 35 % | standard events each platform should send on each page |
| Data quality | 25 % | duplicates, missing parameters, missing event IDs |
| Consent | 25 % | tracking before consent and after a rejection, Consent Mode, banner sync with Shopify |
| Server-side | 15 % | signs that ad platforms also receive events from a server |
Each finding costs points in its category, with a cap per finding type so one noisy platform cannot empty a category. A category the scan could not judge (for example consent, when we could not operate the banner) is left out instead of counted as perfect. Grades:A from 90, B from 75, C from 60, D from 40, F from 0. A critical finding caps the grade at C. A store without any tracking gets no grade.
Being polite to stores
- We only load public storefront pages, a handful per scan.
- Each store is scanned at most once per day per scan type; repeat requests get the cached report.
- Batch scans for our data reports respect robots.txt and never touch the cart or checkout.