Tracking Pixel

What is a tracking pixel?

A tracking pixel is a small piece of code placed on a web page, in an app or in an email. When the page or email loads, the code quietly contacts another company's server and reports what happened: a page view, a click, a sign-up or an opened email.

The name comes from the original version, a tiny image one pixel wide that you cannot see. Your browser has to fetch that image, and the request itself carries details about you. Today many pixels are snippets of JavaScript, but the idea is the same. You may also see them called web beacons, clear GIFs or tags.

A pixel can send information such as:

• The page you were on and the page you came from.
• Your IP address, browser and device type.
• A cookie or ID that lets the pixel's owner recognize you again later.
• Events, like "started a free trial" or "added to cart," and sometimes form details.

Vendors use pixels for two main jobs. Email pixels show whether you opened a message; HubSpot's cookie policy says it uses "clear gifs or pixels in our HTML-based emails" for this. Ad pixels report your visit to an ad network so it can show you ads later and measure whether they worked. That second use is what links pixels to targeted advertising.

What it looks like in a vendor's terms

Pixels are often listed in the cookie policy or the cookie section of the privacy policy. A typical clause reads like this:

We and our partners use cookies, web beacons (also called pixels) and similar technologies on our websites and in our emails. Some of these are placed by advertising partners, who use them to collect information about your visit and show you ads on other websites. A list of these partners is in our cookie table.

• "Web beacons (also called pixels)": the same thing under two names.
• "In our emails": the vendor can see when you open its emails.
• "Placed by advertising partners": outside companies receive data directly from your browser.
• "Cookie table": the list where new partners show up first. Check it when the policy changes.

Atlassian's cookie notice, for example, says it and its partners collect information using web beacons "also known as 'tracking pixels'."

A real change we caught

Venpo flagged this change: OpenAI's ad pixel now appears in CircleCI's cookie policy. CircleCI's cookie policy, updated October 4, 2026, added nine entries tied to OpenAI's Measurement Pixel, which advertisers use to measure results from ads in ChatGPT. A new ad pixel in a vendor's cookie list means one more outside company may now receive data about visits to that vendor's website. A change like this can sit in a cookie table rather than in the main text.

Why it matters to you

• Your team's activity leaves the vendor. Each ad pixel on a vendor's site or login page sends data about your employees to a third company.
• It can count as a sale or sharing. In 2022, California's Attorney General said Sephora's arrangement with third-party tracking companies "constituted a sale" under the CCPA. Sephora paid $1.2 million.
• Lawsuits. Plaintiffs in California have filed many class actions over website tracking tools under the state's wiretapping and surveillance law, the California Invasion of Privacy Act (CIPA). A law signed on September 30, 2026 (SB 690) ends private lawsuits under one CIPA section, on "pen registers" (tools that record who contacts whom), for website and app tracking. Claims under its wiretapping section remain, with damages of $5,000 per violation. See CIPA pixel lawsuits.
• Your own website. If you add a vendor's pixel to your site, you become the business that sends your visitors' data to that vendor. That can bring opt-out duties and legal risk to you.

What to check

• Read the vendor's cookie table and note every advertising pixel and the company behind it.
• Watch for new ad partners after each cookie policy update.
• Check whether pixels run inside the logged-in product, not only on the marketing site.
• Check whether email pixels are used in product emails your customers receive.
• Before adding a vendor's pixel to your own site, ask what data it collects and whether the vendor acts as a service provider under contract.
• Test whether the pixel stops firing when Global Privacy Control is on or ad cookies are refused.

Server-Side Tracking

Server-side tracking is tracking that runs from a company's own servers instead of in your browser. With a normal pixel, your browser sends data straight to the ad network. With server-side tracking, your browser sends data to the website's server, and that server forwards it to ad or analytics partners.

The result is that you cannot see it. Browser tools that block pixels, and your browser's list of network requests, do not show the data that leaves from the server. Cookie banners that only switch browser tags on and off may not stop it either, unless the company wires your choice into its server.

The law still applies. A transfer can still be a sale or sharing under the CCPA no matter how the data travels. An opt-out also needs to reach server-side flows. Global Privacy Control is sent as a header on each request to the server, so a server can read it.

Check whether a vendor's privacy policy mentions sharing data with ad partners "directly" or through "server-to-server" connections. Ask whether your opt-out choices apply to those transfers too.

How Venpo helps

Venpo watches your vendors' cookie policies and privacy policies, and emails you a plain-English alert when a new ad pixel or tracking partner is added. The Fine Print Scan also answers whether each vendor sells your data or uses it for ads.