23 – Tracking and Privacy

The test loads the page and looks at where it forwards the visitor without asking.

What is tested?

Tracking

Requests to known tracking services are identified and counted. Some visitor analytics tools are accepted when configured in a way that doesn't hand over the visitor.

Fingerprinting

Techniques that identify a visitor by combining properties of the browser, without setting cookies.

Ad servers

Requests to ad networks are counted separately, since they almost always mean information about the visitor leaves the website.

Cookies

Cookie lifetimes are assessed. The test distinguishes cookies living over a year, over nine months and over six months, and whether they're set by the website itself or by a third party.

How it affects the score

Every tracker, fingerprinting technique and ad request lowers the score. Long-lived cookies and third-party cookies lower it further. If very many requests of the same kind are found, only the first are listed in the review, but all of them are counted.

Running the test

python default.py -u https://example.com -t 23 -r

Worth knowing

The test measures what the page does before the visitor has consented to anything. That's also the state that matters most legally: a tracker that loads before consent is a problem regardless of what the consent banner says afterwards.