The Trackers We Find on Almost Every Practice Website

A note on what this piece about trackers on practice websites is before we start, because the honest framing matters more than the headline. This is not a survey. Our public scanner went live in late July 2026 and has not accumulated enough results to publish percentages, and we would rather say so than invent a number that reads well.

What this is instead: the categories of trackers on practice websites that our detection rules were built to recognise, written from the sites we have actually run the scanner against. Frequency language stays qualitative on purpose. The categories are firm; the counts are not yet ours to claim.

The seven categories of trackers on practice websites

Analytics. Present on essentially every site. Usually installed once by whoever built the site and frequently duplicated later through a plugin, so the same measurement platform is loaded twice by two different mechanisms.

A tag manager container. One script that loads an arbitrary number of others, edited outside the website by people who may no longer work with the practice. Its presence tells you nothing about what it contains, which is precisely the problem.

Advertising pixels. One or more, corresponding to the platforms the practice has advertised on at any point. They tend to outlive the campaigns that justified them, because removing one requires somebody to remember it exists.

An embedded scheduler or form. Loading in its own frame with its own scripts, unreachable from your page, as covered in the consent gap in embedded forms.

Reviews and maps widgets. Almost always frames, and almost always without a title attribute, which makes them an accessibility finding as well as a tracking one.

A chat widget. Loads on every page, often the single heaviest third-party script on the site, and is frequently the one nobody remembers commissioning.

Call tracking. When present it means a script is identifying the visitor's session in order to swap a phone number, which is the mechanism examined in call tracking and dynamic number insertion. Note that only some of these participate in a consent signal at all: Google documents which of its own tags read one in the consent mode overview, and the chat, reviews and scheduling vendors are generally not among them.

Why this particular set, every time

The list is stable across practices because the commercial requirements are stable. Every practice wants to measure marketing, advertise, take bookings, display reviews, be findable on a map, answer questions quickly, and know which campaign produced a phone call. Each of those wants has an obvious off-the-shelf answer, and the answers are third-party scripts.

That is why the useful question is never whether a practice is careless. It is whether anyone has ever looked at the aggregate, and the answer is usually no, because looking at the aggregate is nobody's job and it requires opening a tool most people in the chain do not use.

The asymmetry in that diagram is the part worth carrying away. Every tracker on a practice website has somebody who wanted it, and no tracker has anybody whose job is to retire it when the campaign ends or the agency changes. Systems with additions but no removals only grow, and the growth is invisible because each individual addition is small and justified.

Which trackers on practice websites actually matter

Ranking by risk rather than by frequency changes the picture, and the ranking depends more on the page than on the vendor.

The clearest problem is an advertising pixel on a page with a health-intent form, because the platforms behind those pixels generally will not enter a business associate agreement, and the page is where a visitor discloses a condition. That combination is the one the free scan flags first, and the reasoning is in do you need a BAA with your analytics vendor.

Analytics on the same page is a judgement call that depends on configuration, particularly whether form interactions are captured as events. Analytics on a location page or a blog post is ordinary measurement and not what any of this was aimed at.

The category that consistently surprises people is the chat widget, because it is usually classified as essential and exempted from gating on that basis. A chat widget on a treatment page can record what a visitor typed before they decided to press send, and it is doing so under an exemption granted because someone reasoned that the page does not function without it.

The tag manager deserves its own note because it behaves differently from everything else on the list. It is not itself a tracker; it is a delivery mechanism whose contents are decided elsewhere, by whoever currently holds access. Its presence on a page tells you nothing about what that page transmits, and the honest answer to what it loads is that you cannot know from the outside. Two practices running an identical-looking container can have wildly different exposure.

That property cuts both ways and the favourable direction is underrated. Because the container is a single script on your page, gating it holds everything inside it, including tags configured by an agency you parted with two years ago and cannot get access back from. It is the one item on the list where a single decision reaches an unknown quantity of unknown things.

The other item worth reconsidering is the duplicate. Practices frequently run the same analytics platform twice, once from the theme and once from a plugin or container, which produces inflated numbers as well as duplicated transmission. Finding a duplicate is a quick win for measurement quality independently of any of the reasoning here, which makes it an easy first thing to fix when the topic is otherwise unwelcome.

How to get your own list

You do not need a tool, though ours is free. Open your site in a private window with the network panel open, load a treatment page, and touch nothing. Every third-party domain listed is a company that now knows a visitor read that page.

Then do the same on a page with a form, because form pages are frequently built differently from the rest of the site, and on a page behind a login if you have one. Compare the three lists. The differences are usually more informative than any single list, and the pattern that shows up most often is that the pages carrying the most sensitive interaction also carry the most tags, because those are the pages an agency instrumented most carefully for conversion tracking.

Two practical notes on doing this properly. Use a private window, because a stored consent decision or an ad-blocker on your own machine produces a misleadingly clean result that bears no relation to what a first-time visitor experiences. And resist the urge to click the banner to see what happens next; the whole question is what leaves before anyone clicks anything, so the interesting portion of the recording is over within the first second.

When you have the lists, the useful next step is not remediation. It is asking, for each domain, two questions: who is this, and who added them. The second question is frequently unanswerable, and discovering that is itself the finding. A third party receiving data from your consultation page that nobody at the practice can account for is a clearer statement of the problem than any score we could produce.

Finally, a note on what we will publish later. As the scanner accumulates results we will report real distributions, with the sample size stated. Until then the categories above are what we can honestly stand behind, and the individual case study in anatomy of a pre-consent data leak is a real timeline from a real site rather than an aggregate. Holding all of it until a visitor agrees is what consent gating does, and it removes the need to adjudicate each of these categories individually.