Included in the scan cycle

Nobody deployed anything. There is a new tracker on your site.

The list of third parties on a practice website is not a decision that gets made once. It drifts. An agency adds a pixel for a campaign and never removes it, a plugin update ships a new analytics call, a booking vendor changes what its own embed loads. None of those touch your site’s code, none of them appear in a changelog, and none of them announce themselves. Every cycle we compare what loaded today against what loaded last time, and name what is new.

Runs on the existing scan cycle · no action required for a flag to raise · last reviewed 30 July 2026

A practice receptionist at a front desk workstation, greeting a patient standing at the counter — The person who would have to notice a new tracker is not looking at network requests. There is no moment in a practice’s week when that check happens.

Undeclared: 5Third parties running on one live practice site that its own current privacy notice never mentions.
Flagged after: 1Cycle. A third party that was not there last time is named the first time it appears, not at renewal.
Code changes needed: 0A tag can arrive without anyone editing the site. That is the whole reason this check exists.
Legal conclusions: 0Drawn anywhere in the report. We record what loaded and when. What it means is your counsel’s call.

01 — HOW A SITE GAINS A TRACKER NOBODY ADDED

Four routes in, and only one of them goes through you

A practice owner who has never authorised a tracking pixel can still have five of them. The tags in the matters on our home page were almost never installed by the person who eventually got the letter about them.

The agency that is no longer your agency: A pixel goes in for a campaign. The campaign ends, the contract ends, the pixel stays. It keeps firing to an ad account somebody else controls, from a page about a procedure.
A plugin update nobody read: WordPress plugins update themselves. A minor version can add an analytics call, a font fetched from a third party, or a session recorder the vendor now bundles by default.
A vendor changing their own embed: Your booking widget, chat box or financing calculator is one script tag you added once. What that script goes on to load is entirely the vendor’s decision, and it can change tomorrow without telling you.
A tag manager edited from somewhere else: Anyone with container access can publish a new tag without touching your website. There is no deploy, no file changed, and nothing in your hosting history to find afterwards.

02 — WHY THIS IS NOT VISIBLE FROM INSIDE

A one-time audit describes a site that no longer exists

The usual answer to “what is running on our website” is to have somebody look once. That produces a list which is accurate on the day it is written and starts decaying immediately, for the four reasons above. The audit is not wrong. It is describing a previous version of the site.

The second problem is that the check is genuinely hard to do by eye. A tracker that loads two seconds after the page settles, or only on pages that carry a form, or only for visitors arriving from an ad, will not be there when someone opens the site to look. The absence of a tracker in one manual check is not evidence that the tracker is absent.

So what has to be true is not that somebody is thorough. It is that the check runs on a schedule, from outside, the same way every time, and keeps the previous answer to compare against.

03 — WHAT THE CYCLE ACTUALLY PRODUCES

A diff against last time, with a date on both ends

Each cycle loads your pages in a real browser and records every outside company contacted, when it was contacted, and whether a consent decision had been recorded before it happened. That record is kept. The next cycle compares against it.

What is new: Named Any third party present this cycle and absent last cycle, with the date it first appeared and the page it appeared on.
What is gone: Recorded A tag that stopped appearing is recorded too. “When did we take it off” is a question that gets asked later, and it deserves a dated answer.
What your notice does not mention: Gap The observed list is compared against the third parties your own privacy notice names. Anything running and undeclared is surfaced as a gap, not as a verdict.
What fired before consent: Observed A new tag executing before a decision was recorded is the finding that matters most, and it is reported as an observation with a timestamp.

All four land in the same dated document as the rest of the cycle. There is no separate dashboard to log into and no alert to acknowledge, because a finding that only counts when somebody clicks it is a finding that gets missed.

04 — WHAT IT COSTS

It rides a cycle you are already paying for

This is not a module and it is not an add-on. The scan that checks your consent gate is already loading your pages; recording what loaded and comparing it against last time costs nothing extra to run, so it is not priced separately. It is included with consent management at every level, and it is on from the first cycle.

Included: Every cycle report, the retained history, and the comparison against your notice.
Also included: Additional domains on the same practice, each watched on the same cycle.
Not available at any price: Removing the tag for you. That is a change to your website, and we do not make changes to your website.

See what the plan includes

05 — THE LIMITS, STATED PLAINLY

Four things it deliberately refuses to do

It does not remove the tagWe report what appeared and where. Taking it off the site is a change to your website, and making changes to your website is not something we do.
It does not tell you the tag is unlawfulWhether a given third party on a given page creates exposure is a legal question. We record that it was there, on a date. Your counsel decides what that means.
It does not send you a task listNothing here requires you, your webmaster or your developer to act for the product to keep working. The record is produced whether or not anybody reads it.
It does not watch anything but the browserThis sees what a visitor’s browser loads. Server-side integrations, data your practice sends from its own systems, and anything inside your EHR are all out of scope.

Find out what is on your site right now.

The scan names every third party your pages contact and when each one fired. It is the same observation this check makes every cycle — this is just the first one.

Scan your site How the consent gate works