The gtmspy scanner

gtmspy audits an online store's tracking setup (analytics and ad tags, consent banner behaviour) when someone requests an audit of that store.

What a visit does

• A real Google Chrome browses like a shopper: the homepage, a category, a product, add to cart, cart and checkout. It never places an order.
• It visits a few times: without answering the cookie banner, after rejecting, after accepting, with a tracker blocklist, and on a phone-sized screen.
• Tracking sends as it would for any visitor, so the visit can appear in the store's analytics.
• One store at a time, at a person's pace. No logins, no forms filled except the cart.

How to recognise it

Requests to the audited store are signed with Web Bot Auth (Signature-Agent: "https://bot.gtmspy.io", tag web-bot-auth). Our public key is at /.well-known/http-message-signatures-directory. The user agent is Chrome's own, followed by gtmspy/1.0.

We never fake a browser fingerprint or user agent, use stealth tools, solve CAPTCHAs or rotate IP addresses.

Opt out or ask a question

Contact bot@gtmspy.io. We add opted-out stores to a list that is never scanned again.