Website Scanning Methodology & Data Rights
Last updated: 1 November 2026
If you've received an email or an audit from us, this page explains how we looked at your website, what we do with the results, and how to opt out.
What we do
TrackWatch is operated by Stuart McCulloch, trading as TrackWatch. We run a technical scanning service that observes how public-facing websites handle visitor consent and third-party tracking technologies. Our scans are automated and non-intrusive. We never log in, never type anything into a website, and never interact with its visitors. The only things our browser clicks are the cookie banner's "Accept" button and, on an online shop, one product's "Add to cart" button, each as an ordinary visitor would.
We identify technical configurations such as:
- Whether a consent mechanism (for example, a cookie banner) is present and functioning
- Whether tracking pixels (for example, Meta Pixel or Google Analytics) load before or after consent
- Whether conversion tracking is properly configured
- Whether tracking tools send visitors' personal details, such as an email address or phone number, to advertising or analytics platforms, and how those tools are set up to collect them (for example, whether the Meta Pixel is set to collect details typed into forms)
- On online shops, whether product pages handle consent and tracking the same way as the homepage, and whether shopping activity (viewing a product, adding it to the basket) is recorded
- Whether social media widgets, such as a Facebook Like box, set cookies before a visitor has made a choice
- The website's underlying technology platform
We also check whether a business appears to be running paid advertising on Google or Meta, using public advertising data, because a tracking fault mostly matters where a business is paying for ads.
What happens with what we find
When a scan finds a serious problem, for example advertising tracking that runs before a visitor has agreed to it, the business may be used in one of two ways, and only ever one:
- We contact the business ourselves. We email a link to a plain-English audit of its website, with optional paid help to fix the problem. Paying for help is entirely optional; the audit itself is free. We send at most three emails, within 30 days, and stop as soon as you reply or opt out.
- Or we supply the finding to one agency that helps businesses fix these problems, under our Data License & Usage Terms.
Each business is used once. Once our series of emails to a business ends, or once a business has been supplied to an agency, it is never contacted by us again, never supplied to anyone else, and never re-offered after a later scan. The only exception is replying if that business gets in touch with us. Our system enforces this directly.
We only contact, or supply findings about, businesses confirmed as live, registered limited companies or LLPs.
How we scan
| What we do | What we don't do |
|---|---|
| Load a website's public homepage in a controlled browser that identifies itself as a standard Chrome browser, so the site behaves as it would for an ordinary visitor | Log IP addresses of website visitors |
| Observe which scripts, pixels and banners load, and in what order, and read the settings tracking tools load into the page | Set cookies or store data on visitors' devices |
| Click "Accept" on the cookie banner, as a visitor would, to see whether tracking changes afterwards | Type into or submit any form, log in, or use a payment system |
| On an online shop, read the site's public sitemap (and, where needed, up to three of the pages it lists) to find one product page, then load that page twice: once as a brand-new visitor who hasn't made a consent choice, and once after accepting the banner on the homepage | Visit any basket, checkout or account page |
| On that product page, click "Add to cart" once, as a shopper would, to see which shopping events are recorded. The basket belongs to our test browser and expires on its own; nothing is ordered and no details are given | Choose product options, go to the basket or checkout, or buy anything |
| Check the requests tracking tools send for personal details such as email addresses or phone numbers. If any are found, we record only the kind of detail and where it was sent; the detail itself is discarded on the spot | Store, show or share any personal details we see in tracking traffic |
| Take a screenshot of the homepage as it appeared, and note the website's visible technology stack | Scrape content, pricing or proprietary information |
| Read a small number of other public pages on the same site (such as contact, about or privacy pages) to find the company name, registration number or a business contact email | Scan sole traders, unincorporated partnerships or personal websites |
| Cross-reference the business against Companies House to confirm it's a live, registered Ltd or LLP | Contact, or supply findings about, any business we cannot confirm as a Ltd or LLP |
Each scan is one automated visit to the site, normally lasting a few minutes at most. No visitor data is collected or stored.
The Full Scan: only when the owner asks
Everything above describes the scans we run without being asked. A website owner can also buy a Full Scan of their own website. It goes further: it visits the cart and checkout, runs one search for a made-up word, and types a made-up test identity into the site's newsletter and contact forms and submits them, to see whether those details reach advertising or analytics platforms. At the checkout it fills in the test details but never places an order.
A Full Scan never runs unless someone has confirmed control of the website, by pressing a confirmation link we email to an address on the website's own domain. Without that confirmation our system refuses to run it. The test messages it sends come from an address ending @trackwatch.info and are named in the owner's results so they can be deleted. Terms: trackwatch.info/terms.
Why we scan
Businesses operating websites have obligations under UK GDPR, EU GDPR, PECR and related regulation to make sure tracking technologies respect visitor consent. Many businesses do not know that their website has a configuration that creates compliance risk or wastes advertising spend. Our service exists to surface these issues so a business can fix them, on its own, with our help, or with the help of an agency.
Your rights as a scanned business
Right to know. You may request a copy of any data we hold about your business by emailing hello@trackwatch.info. We aim to respond within one month.
Right to correction. If you believe our technical findings are inaccurate, you may request a re-scan. We will verify and update our records where appropriate.
Right to object / opt out. You may ask for your business to be excluded from future scanning. Email optout@trackwatch.info with your business name and website URL. If we've emailed you, you can also reply asking us to stop, or use the opt-out link in our email. We process opt-out requests within 14 days and confirm once completed. Once you opt out, your website is checked against our exclusion list before any future scan, so it will not be visited again. This also works if we have never scanned you. If a finding about your business was already supplied to an agency before your request, we cannot recall it, but we will ask the agency to stop using it and delete it.
Right to erasure. You may ask us to delete your business's data from our systems. We will comply unless we need to keep it for a legal reason (for example, a record tied to a completed sale, kept as our transaction record), and we keep the minimal records described under "How long we keep it" so that your business is never contacted or scanned again.
Data we hold
For each scanned business, we typically hold: business name, website URL, technical findings (consent and pixel observations on the homepage and, for online shops, one product page, including the kind of any personal detail seen in tracking requests but never the detail itself), a screenshot of the homepage taken during the scan, severity classification, technology platform, whether the business appears to be running paid Google or Meta ads, a business contact email where one is publicly listed, the Companies House number and status where confirmed, and whether and when the business was contacted by us or supplied to an agency. For businesses we contact, we also hold the audit page we sent them.
A business email address can identify a person where it is based on their name (for example, firstname@company.co.uk). We treat such addresses as personal data. Where we have a choice, we use a general business address instead.
We do not hold: home addresses or personal contact details of individuals; personal (non-business) email addresses; financial information; customer or visitor data, including any personal details seen in a website's tracking traffic; or IP addresses and browsing behaviour.
How long we keep it
Scan data, including audit pages and screenshots, is deleted automatically 12 months after the scan, or earlier if you opt out. Every deletion run is logged. A record that has been sold to an agency is kept as our transaction record. We permanently keep a minimal record that a business was contacted by us or supplied to an agency (its name, website and the date), and a record of any opt-out, because that is how we make sure a business is never contacted, offered or scanned again.
Our lawful basis
We process business data under legitimate interests (Article 6(1)(f) UK GDPR / EU GDPR). When we email a business about its findings, we send at most three emails within 30 days, and only to limited companies and LLPs, which PECR allows without prior consent provided we identify ourselves and offer a simple opt-out; every email we send does both. We have carried out a Legitimate Interest Assessment covering this processing, available on request from hello@trackwatch.info.
Who we share it with
Findings about some businesses are supplied to agencies, who are licensed to use them only under our Data License & Usage Terms (no resale, lawful basis required, deletion after 12 months). If a business buys our "Fix it for me" service, we share the details needed with the specialist who carries out the work. We also use service providers to run the business: hosting (Hetzner, Germany), email (Google Workspace), payments (Creem), and a provider of public search-advertising data.
Where our data is held
Our systems are hosted in Germany (EU). We apply UK GDPR to all processing relating to UK businesses.
Contact us
For questions about our scanning methodology or a data rights request: hello@trackwatch.info. To opt out of scanning: optout@trackwatch.info. Post: Stuart McCulloch, trading as TrackWatch, PO Box 6945, London, W1A 6US.
If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office: ico.org.uk, or by phone on 0303 123 1113.
Data protection registration with the Information Commissioner's Office (ICO): Stuart McCulloch, registration reference ZC275210.