Tracker inventory: what is actually running on your site

You cannot manage what you have not inventoried. Before a consent banner can block or release the right trackers, you have to know what is actually running on your site. Most teams are surprised the first time they scan their pages and find trackers they did not author, set by plugins, tag managers, or third-party widgets. This post explains what a tracker inventory is, why it matters, and how to keep it honest as your site changes.

What a tracker inventory is

A tracker inventory is a living list of every script, pixel, iframe, and storage item on your site that reads or writes visitor data. Each entry captures what the tracker is, where it comes from, what category it belongs to (necessary, analytics, marketing, preferences), and which pages it appears on. The point is to turn a hidden runtime reality into something you can see, classify, and control.

Why it matters

• Without an inventory, enforcement is guesswork. You cannot block a tracker by category if you do not know it exists.
• Privacy laws expect your notices to match reality. If your banner lists six trackers and the page loads nine, the notice is inaccurate.
• Inventories drift. A marketing plugin added last quarter can silently introduce new trackers that nobody scoped for consent.
• During an audit, an inventory is the difference between an answer and a guess.

How trackers get categorized

Each tracker maps to one of a small set of fixed consent categories. The category decides when the tracker may load and whether it is gated behind a consent choice.

How a scan works

A scan loads the page the way a visitor would, observes which scripts, iframes, and storage items appear, and maps each to a known tracker definition. The result is a per-page list that you review, approve, and publish as your declaration. The key is that the scan reflects the runtime, not just the source code, because tag managers can inject trackers dynamically.

Keeping the inventory honest

• Scan after any release that touches marketing, analytics, or third-party embeds.
• Treat new trackers as a review step, not an automatic publish. Someone should classify them.
• Re-scan on a schedule, weekly or monthly, to catch drift between releases.
• Make the inventory the single source your banner reads from, so the notice and the enforcement always agree.

A tracker inventory turns the invisible part of your site into something you can govern. Once you know what is running and why, the rest of consent work, notice, enforcement, and records, has a solid foundation to stand on.

Materially reviewed July 11, 2026. Regulatory and implementation guidance is general information, not legal advice.