The MeasureProof Method
What we check · How we bound each claim · What we don’t claim
How the scan works
The free scan is a live-site observation — the same tracking requests a first-time visitor’s browser would make. Nothing is installed on your site, and no access to your accounts is required or used. It runs in a fresh, sandboxed browser with no cookies or prior state, and records the tracking requests each page load sends.
Because the evidence source is the rendered page, every claim is bounded by it. The scan reports the tracking requests sent during that visit; anything that requires seeing inside your GA4 or GTM configuration is named as exactly that — something we cannot prove from the page alone. The same external observations can be rerun continuously as a weekly watch, so a change from one week to the next is caught the same way it is seen here.
What we check
Each check states a bounded claim and renders the evidence behind it. A check that cannot be proven mechanically is cut, not polished.
Every check is bounded below. The checks index lists the same set in brief, and links a full mechanism explainer where one exists.
- Checks
- which tags and pixels loaded, the IDs they carry, and how each behaved — loaded, fired, or loaded but never seen firing on this visit.
- Evidence
- the request log — vendor, ID, and load path for each.
- Doesn’t prove
- ownership, intent, whether data is forwarded onward server-side, or tags that fire only on later pages or interactions. The inventory is what this page requested on this load, nothing more.
Analytics & tag managers
Ad & retargeting pixels
Session replay
Product analytics
Adobe Experience Cloud
Email & CRM
Media & attention
- Checks
- the same GA4 measurement ID sending more than one page_view beacon on a single load.
- Evidence
- the duplicate /g/collect requests with a matching measurement ID and page_view event name, with timestamps, plus any loaders observed sending them.
- Can’t prove externally
- whether this is a duplicate install (for example a hardcoded gtag.js alongside a GTM-managed tag) and which reports it inflates — that needs read-only access to the GA4/GTM configuration.
- When silent
- no duplicate page_view was observed in this captured load.
- Checks
- two or more distinct pixel IDs for the same supported ad platform — currently Meta and TikTok — firing on one page load.
- Evidence
- the separate pixel-fire requests, each carrying its own ID, with timestamps.
- Can’t prove externally
- whether both pixels are intended (for example your own alongside an agency’s) or one is a leftover that should be removed — that needs account context.
- When silent
- at most one pixel ID was observed for each supported ad platform (Meta, TikTok) in this captured load.
- Checks
- a Universal Analytics snippet (analytics.js / ga.js) still loading, or a UA collection hit still being sent. Standard UA stopped processing data in July 2023.
- Evidence
- the UA snippet or hit request observed on the page.
- Can’t prove externally
- whether the snippet is hardcoded or GTM-managed, and whether anything still reads the old UA property — that needs the configuration view.
- When silent
- no Universal Analytics snippet or hit was observed in this captured load.
- Checks
- an exact retired Adobe DTM (Dynamic Tag Manager) container filename — the satelliteLib- prefix — loading on the page. DTM was frozen read-only in 2020 and retired shortly after, so the container can no longer be edited.
- Evidence
- the container request, matched on the exact retired filename shape.
- Can’t prove externally
- whether the tags inside the frozen container still fire correctly, or what they were configured to do — that needs the Adobe Launch/DTM admin console. Classic Adobe AppMeasurement is a separate product with no confirmed end-of-life; this claim is about the DTM tag manager only.
- When silent
- no retired DTM container filename was observed in this captured load.
- Checks
- a tracking loader fetched on the page with no corresponding collection request observed — restricted to the vendors with a definite fire signal, currently GA4 (per measurement ID) and Meta, so a blind spot is never read as an absence.
- Evidence
- the loader request, and the absence of the matching collection request on this load.
- Can’t prove externally
- whether collection is gated behind consent, fires only on later interactions, or the tag is genuinely dead — one pre-consent page load cannot distinguish these.
- When silent
- every GA4 and Meta loader observed also had a matching fire in this captured load.
Consent is probed across separate passes, each a fresh context with no prior state, so what fires before any choice can be compared with what changes after one:
- Checks
- a supported measurement request — GA4, Universal Analytics, Meta, or TikTok — sent before any interaction, on a load where a supported consent banner was confirmed visible and unanswered after page settle.
- Evidence
- the outgoing request timestamps and the separately recorded consent observation — banner state after settle, interaction state, scan region, and the wait window — scoped strictly to that observable state, plus which requests were considered.
- Can’t prove externally
- whether this behavior was intended by the CMP or Consent Mode configuration, what the destinations retained or reported, and which legal framework applies — none of that can be determined from this scan.
- When silent
- no supported measurement request (GA4, Universal Analytics, Meta, TikTok) was observed firing before interaction on a captured load where a supported banner was confirmed visible.
- Records
- the Consent Mode parameters present on outgoing hits — for example gcs, gcd, dma — rendered alongside consent findings as evidence.
- Not a verdict
- this reports which consent signals were on the wire, not whether consent was legally valid or correctly configured.
The reject-path comparison — whether rejecting consent actually changes the signal sent — stays behind a higher evidence gate and is not presented as a public finding until it clears validation.
What we don’t claim
- No composite score. A single 0–100 number hides more than it shows. The summary is the finding count and top severity, each linked to its evidence.
- No verdicts without outcome truth. From the live site, we say “this changed” or “this looks off” — never “your business is fine, it’s the tracking.” That adjudication requires reconciling against real orders and leads, which is a deeper, connected rung of the product.
- No account-specific impact claims. We can see a tag fire twice; we cannot see which of your reports or conversions it inflates without read-only access to your setup. The report says so per finding.
- No bare “all good.” A clean result still shows its work — every validation that ran and passed, listed by name.
The line is simple: what the page shows externally, versus what only your accounts can.
Proved from the page
Needs the inside view
When we stay silent
When site behavior falls outside what a check can evaluate reliably — an unsupported consent banner, ambiguous timing, regional variance from our US scan region, or a page we could not fully load — the report records a coverage gap, not a finding. A miss is stated plainly; it is never counted as a pass.
Evidence handling
Raw browser capture is ephemeral. We persist only the minimized observation needed for findings and triage: cookies, auth headers, request bodies, and raw full URLs are dropped before storage; request evidence is retained only in redacted, vendor-aware, or PII-sanitized form. Measurement IDs are partially masked in evidence rendered on shareable surfaces, so a report stays verifiable by the site owner without being harvestable. See the privacy policy and security model for data handling and retention.
Mistakes
A false finding in a trust product is fatal, so validations under-claim by design and are tested against known sites before they ship. If you believe a finding on your report is wrong, tell us at [email protected] — a confirmed false finding takes the validation out of the shipped set until it is fixed.
See it on your own site: run a free scan.
Last updated: July 24, 2026