The vendor fingerprint library

The roster

Grouped by what the vendor does. Where a category has a measured footprint in the latest crawl, it is shown beside the heading — that is the share of pages making at least one request matched by any rule in that group.

How a rule works

Each entry is a URL pattern plus, where the vendor exposes one, a second pattern that extracts the account identifier — the GTM container, the GA4 measurement ID, the Meta pixel ID. A request is attributed to a vendor when its URL matches the first; the tools show you the second so you can see whose property is collecting, not just that something is.

Every rule ships with a sample URL it must match and, where a near-miss exists, a negative URL it must not — for example, Google Tag Manager's container script counts while its noscript iframe on the same domain does not. Those pairs run as tests, so a rule that gets sloppier fails before it ships. Patterns are also restricted to the RE2 subset (no lookaround, no backreferences) so the identical rule runs unchanged in the browser tools, in Python, and inside BigQuery.

The match patterns themselves are not published; the roster and the method are. If you want to verify a specific detection, the Pixel & Tag Scanner runs the real rules in your browser against any requests you paste — including ones you expect not to match.

One honest caveat about that tool: it ships its own copy of the signatures and currently trails this list by 14. The report uses the full 66; the scanner does not yet detect Adobe Analytics, AdRoll, Awin MasterTag, Comscore, and 10 others. So a clean scan is not proof of nothing firing.

Scope, and what it misses

• Signature-based, so first-party proxying is invisible. A site that routes collection through its own domain is not detected by this or any similar library. That is a real and growing blind spot, and it means every share we publish is a floor.
• Presence, not consent. A match means the request happened. It says nothing about whether the visitor agreed to it — that is what the Consent Checker is for.
• Categories are editorial. Several vendors could sit in two of them; each appears once, in its primary role.
• Coverage is deliberately mainstream. The library targets the vendors that show up at scale rather than every product that has ever existed.