The Pixel You Installed and Forgot

What a pixel actually is

Despite the name, not an image. A small piece of code that runs when somebody loads your page and reports back to a third party.

What it reports varies, and it is usually more than people assume: which page was viewed, when, from what kind of device, and an identifier connecting that visit to the same person's activity elsewhere.

Where it is configured to track specific events, it also reports those: a form submitted, a purchase, a value.

It does all of this on every visit, for every visitor, from the moment it is installed until somebody removes it.

Why yours is still running

Because removal is nobody's job.

Installing a pixel is a five-minute task with an obvious owner and a clear reason: a campaign is starting and it needs to measure results.

When the campaign ends, nothing prompts anybody to take it out. The agency's engagement finished, the person who added it moved on, and the code sits in the template.

Two years later it is still collecting information about every visitor, on behalf of a company you no longer have a relationship with, for purposes nobody in your business could describe.

What you are responsible for

The uncomfortable part, and the reason this is a compliance question rather than a tidiness one.

You put the code there. Information about your visitors is being collected and shared because of a decision your business made.

That makes it something you should be able to account for: what is collected, by whom, for what purpose, and where your visitors were told about it.

Not knowing is not a defence and is a common position. Most small business sites are running at least one thing nobody can explain.

This is a general description rather than legal advice, and specific obligations depend on where you operate and who your visitors are.

Finding what is running

• Open the network view and list every external domain requested.
• Open your tag manager and read what is inside it.
• Search your theme files for pasted script blocks.
• Check your plugin list for anything analytics or marketing related.
• Check individual pages, where code is often pasted separately.

The third and fifth are where forgotten code hides, because it was added by editing rather than through a tool that lists it.

For each one, three questions

What does it collect, which the provider documents and most people have never read.

Who is it for, meaning is there an active relationship and a live campaign, or is this residue.

Where were visitors told, meaning does your privacy policy name this specific third party and describe what it does.

Anything failing the second question should be removed. Anything passing the second and failing the third needs the policy updated rather than the code removed.

A worked example

An independent retailer audited a site nobody had considered complicated.

They found four tracking pixels. One belonged to a social platform where they still advertised. One belonged to a platform they had tried for two months in 2018. One had been added by an agency whose engagement ended in 2019. The fourth nobody could identify at all until they looked up the domain and found it belonged to a remarketing service the same agency had used.

Their privacy policy mentioned analytics and cookies in general terms and named none of them.

They removed three, kept the one in active use, and rewrote the relevant section of the policy to name that provider, describe what it collects, and link to its own policy.

The removal also took about eighty kilobytes and three external connections off every page, which was not the reason for the exercise and was a welcome result.

Your privacy policy is probably wrong

Not through dishonesty. Through drift.

Most were written when the site launched, describe the tools in use at that moment, and have never been revisited while tools were added and removed around them.

A policy saying we use cookies to improve your experience describes nothing and does not tell a reader what is actually happening.

What is useful, and what is generally expected, is naming the third parties, saying broadly what each collects, saying why, and linking to their own policies so somebody can follow the chain.

Update it whenever you add or remove something, which is a two-minute job at the time and a research project two years later.

Consent, and the order of operations

Where consent is required for this kind of tracking, the sequence matters and is frequently wrong.

A pixel that loads when the page loads has already collected and transmitted before anybody has agreed to anything, which makes a consent banner decorative.

To mean anything, non-essential tracking has to be held back until consent is given, which usually means loading those scripts through a consent tool rather than pasting them into the template.

That is a configuration change rather than a policy change, and it is the part most small sites have not done.

Write down what each one is for

The step that prevents this recurring, and it takes one document.

A short list: each tool, who asked for it, what it does, when it was added, and when it should be reviewed.

The reason forgotten pixels survive audits is that nobody is certain what removing them would break, so they stay by default.

A note saying added for the spring campaign, agency X, remove after June makes the decision obvious in eighteen months instead of unanswerable.

The counter-case

Stripping all tracking is not the goal and would be its own mistake.

Analytics you actually read informs real decisions. A pixel supporting advertising you are currently running is doing a job, and removing it produces campaign data that is wrong rather than absent, which is worse than leaving it.

There is also a genuine cost to removing something you cannot account for but that somebody else depends on. Ask before deleting, particularly where an agency or a supplier may be relying on it.

The standard is not zero tracking. It is that everything running is something you chose, can describe, and have told people about.

The audit

1. List every external domain your pages request.
2. Open the tag manager and the theme files.
3. Identify what each one is and who it serves.
4. Remove anything with no live purpose.
5. Name the survivors in your privacy policy.
6. Load non-essential ones after consent, not before.
7. Record what each is for and when to review it.

Most sites remove two or three things in an afternoon and can finally describe what the rest do.

The performance side of the same problem is covered in third-party scripts you forgot about.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.