Website Tracking & Privacy Risk Analysis
Your Website Should Bring In Business. Know What It Sends Out.
You approved a website. You may not know every outside company it communicates with—or what those companies receive.
The free C² Privacy Engine examines website tracking and privacy choices, separates GPC signal delivery from site acknowledgment and observed behavior, and gives you a concise visual report with up to three priorities and a copyable website-team checklist.
Start My Free Privacy ScanFree scan. No account required. Test forms are never submitted.
- No account required
- Free website scan
- Real browser analysis
- Third-party data flow detection
- Current litigation intelligence
- Informational risk guidelines
Start My Free Privacy Scan
Required fields help tailor your report. We never submit your forms.
Risk scores, classifications, statistics, and technical findings are informational guidelines only. They are not legal advice and are not a determination that any law has been violated, that any technology is illegal, or that any organization is or is not legally compliant. Consult qualified legal counsel regarding your specific circumstances.
Look beyond the policy
A Privacy Policy Describes Your Intentions. Your Website’s Behavior Tells Another Story.
A new plugin. An advertising campaign. An embedded scheduling tool. Each website change can introduce another connection to an outside provider.
Knowing what is installed is a start. Understanding what it transmits—and when—gives you something concrete to review.
What your scan can show
See What Deserves a Closer Look.
Which outside services are involved?
Discover third-party connections observed on the pages examined.
When does information leave the browser?
Examine detected activity around page loading, consent, and interaction.
Can information leave before someone submits a form?
Synthetic test values help identify certain pre-submission transmissions without submitting the form.
What does the legal context mean for your next conversation?
Review relevant litigation intelligence alongside the technical findings, without treating a detected technology as proof of a violation.
Findings reflect observed behavior. Consent tests may be not tested or inconclusive; a missing detection is not proof that no collection occurs. Potential privacy and wiretap concerns require contextual technical and legal review.
Your report includes prioritized consolidated findings and business-specific tool-review guidance to help identify what was observed, why it merits review, and where to involve your website provider or legal counsel.
The owner’s quick guide
A banner is a choice—not proof of blocking.
What should my banner do?
Give visitors understandable choices and make the website behave consistently with them. A visible banner or a named consent platform does not prove optional tools wait, stop or remember a choice. Ask your website team to demonstrate Accept, Reject and changing a choice later.
What is GPC, in plain English?
Global Privacy Control is a browser setting that sends an opt-out preference for sale, sharing and targeted advertising. It does not replace every consent choice. We separate whether the signal was confirmed, whether the site visibly acknowledged it, and whether relevant tracking changed.
Does an inconclusive result mean something is broken?
No. A test may lack a clear control, enough time or relevant baseline tracking to compare. No relevant baseline means we cannot measure a change—not that GPC was ignored. Review what was actually tested before deciding whether a fix is needed.
Which laws should I review?
Use the report’s state-law context as a conversation starter with qualified counsel. Your visitors’ residence, business coverage thresholds, exemptions and federal or sector rules can matter. A scan is not a verdict about which laws cover your business.
A practical next step
Turn Uncertainty Into Better Questions.
Use your findings to ask your website provider:
- Why is this technology installed?
- What information does it receive?
- Is that collection necessary for the service?
- Does its behavior match our privacy disclosures and consent choices?
- What needs technical investigation or legal review?
Your concise visual report highlights up to three priorities. Copy the website-team checklist directly from the report to share those priorities, test coverage and follow-up questions with your provider. Keep the conversation grounded in observed behavior, not assumptions about what a tool should do.
Who this is for
Built for Businesses That Take Visitor Privacy Seriously.
Whether you operate a medical practice, law firm, online store, or service business, understanding your website’s data flows is part of understanding your business.
If a website uses third-party JavaScript, tracking, analytics, embeds, advertising, chat, session replay, scheduling systems, or forms, it may warrant review. Relevant industries include:
What is at risk?
What the scanner evaluates
Detection alone does not mean illegality. These are technical observations for informational review.
Where is the risk?
Federal and 50-state litigation intelligence
Federal law may be relevant nationally. Some states currently show greater website-tracking litigation activity, stronger website-specific precedent, statutory remedies, or more active plaintiff litigation. State classifications range across Very High, High, Elevated, Moderate, Lower, and Limited Data — and are generated from ongoing intelligence rather than fixed labels.
When does the risk occur?
Many technologies transmit data before you submit anything
The scanner attempts to identify when observed third-party communications occur relative to page load, consent, and user interaction. Only tested conditions are reflected in the report.
Why is this happening?
Convenience technology carries hidden data flows
Analytics, advertising, chat, scheduling, and review tools make websites easier to run — but each one can quietly transmit visitor activity to outside companies. Much of this happens automatically, often before a visitor consents or intentionally submits information. Business owners are frequently unaware of what their own website transmits. This scan offers a starting point for reviewing observable browser activity, not a complete inventory of every transfer.
How does the scanner work?
Deterministic, evidence-based technical analysis
Real browser scan
We load your site in an automated Chromium browser and prioritize pages that typically contain forms or tracking (contact, appointment, checkout, quote, and more).
Network observation
Requests observed during the tested browser session are inventoried by destination, timing, method, and first- or third-party classification. Sensitive values are automatically redacted; backend transfers are outside this observation.
Synthetic interaction test
We type clearly synthetic marker values into form fields — but never submit them — and watch whether that data leaves the browser before submission.
Consent comparison
Where supported controls can be exercised, we compare acceptance, isolated rejection and Global Privacy Control (GPC) behavior. When time and clear controls allow, we also test a return visit with retained browser storage and later withdrawal in the same session. The report states which steps were actually observed. Not tested or inconclusive is not a failure; not every interface can be exercised.
Start With Visibility.
Find out what the scan observes. Review the findings with the people responsible for your website. Decide your next steps with better information.
This scan provides informational technical findings and risk indicators, not legal advice or a compliance certification. Results reflect the pages, interactions, and conditions tested. A scan may not detect every technology or data transfer, including backend activity. Consult qualified legal counsel about applicable requirements and your circumstances.