Glossary
Tracking pixel
A tracking pixel is a resource — historically a one-pixel transparent image — embedded in a page or an email purely so that requesting it tells a server the content was loaded. It needs no JavaScript: the request itself is the signal, and it carries the visitor's IP address, user agent, referring URL and any cookies already set for the pixel's domain. Most modern advertising tags are scripts that do considerably more, and the pixel remains as the fallback and as the mechanism in email.
What the request discloses
The IP address of the client, which gives an approximate location and identifies the network.
The `User-Agent`, naming the browser, version and platform.
The `Referer`, which names the page the pixel was loaded on — the tracking part, since it says which page was viewed.
Any cookies previously set for the pixel's own domain, which is how one visit is linked to another across sites.
Query parameters in the pixel's own URL, which is where an event name, a campaign identifier or an order value is usually carried.
Pixels and tags
A script tag can read the page, observe interactions, set first-party cookies and send several events. A pixel records one request.
Most advertising platforms ship a script and fall back to a pixel where scripts are blocked or unavailable.
In email, scripts do not run at all, so the pixel remains the only measurement mechanism — which is why mail clients now proxy or pre-fetch images, breaking the signal deliberately.
A `<noscript>` block containing a pixel beside a script tag is the standard arrangement, and it is easy to miss when auditing what a page loads.
Some platforms also use a `1x1` iframe or a `sendBeacon` call for the same purpose, which are not images and do not appear when filtering a network panel by image type.
Why they matter for consent
A pixel that loads on page render has already sent the data before any banner was answered.
Because it is markup rather than a script, it is frequently overlooked by consent implementations that gate script execution.
The same applies to third-party embeds that include their own measurement, such as a video player or a social widget.
The reliable arrangement is that no measurement markup is in the page until consent is recorded, which is a template question rather than a script one.
How to find them
The network panel filtered by images shows small requests to third-party domains, which is the classic signature.
Search the page source for `<noscript>` blocks and for image tags whose source is on another domain.
Server-side tagging changes the picture: the request goes to a first-party subdomain and is forwarded onward, so the origin looks like yours.
List the distinct third-party domains contacted before any interaction; that list is the substance of what the page discloses about its visitors.
Check the email templates as well as the website. Marketing platforms embed an open-tracking pixel by default, and it is governed by the same rules as anything on the site.
Frequently asked questions
- Does a tracking pixel need JavaScript?
- No. The request for the resource is itself the signal, which is why pixels work in email and inside noscript blocks.
- What does a pixel actually send?
- The IP address, user agent, referring page, any cookies for the pixel's domain, and whatever is encoded in its own URL parameters.
- Do pixels require consent?
- Where they are used for non-essential measurement or advertising, the same consent requirements apply as to any other tracker.
Sources
Related
VeriFixScan crawls a site and applies its checks to every page it reaches, keeping the evidence behind each finding. Scanning one website is free.
Scan a website