Meta’s advertising and conversion-tracking tag for Facebook and Instagram. On page load and on events it sends data in standard HTTP headers, which may include the visitor’s IP address and browser information, plus page location, document, and referrer. It collects the Pixel ID and the Meta cookie, it tracks buttons clicked, their labels, and pages visited as a result, and it sends form field names, such as email or address. With Advanced Matching on, it also sends customer data the site holds, hashed with SHA-256: email, phone, first and last name, city, state, zip, country, date of birth, gender, and an external ID.

Sources: Meta Pixel overview and Advanced matching, developers.facebook.com.

TikTok’s advertising tag. Per TikTok it gathers the IP address (for geolocation), the user agent (device make, model, OS, browser), timestamps, ad and event information, and descriptive page metadata, structured microdata, page performance data, and button clicks. First-party cookies are optional, but third-party cookies are on by default. Advanced Matching adds hashed email and phone.

Sources: About TikTok Pixel and Advanced Matching for Web, ads.tiktok.com.

Google’s analytics platform. It collects device and browser data, geographic data, and on-site activity, and it mainly uses first-party cookies. Google states it does not log or store IP addresses, though the IP is used in transit to derive coarse location. On apps it uses an app-instance identifier.

Source: Safeguarding your data (GA4), support.google.com/analytics.

Google’s conversion-tracking and remarketing tags. They store cookies with a unique identifier for the user or the ad click (the GCLID, Google Click Identifier). When a visitor converts, the tag reads this and sends it to Google Ads with the conversion. Enhanced conversions add hashed customer data such as email. The setting is made at the account level, and new conversion actions inherit it. Sources: How Google Ads tracks website conversions and About enhanced conversions, support.google.com/google-ads. Full profile: /en/resources/tags/profiles/google-ads/.

Sources: How Google Ads tracks website conversions and About enhanced conversions, support.google.com/google-ads.

LinkedIn’s B2B advertising tag. Per LinkedIn, for every page load it collects the visitor’s IP address, browser and device characteristics, page URL, referrer, and a timestamp, LinkedIn truncates or hashes the IP addresses. When a visitor is logged in to LinkedIn, the data can be connected to their profile. Its cookies include li_fat_id, a first-party cookie that is on by default for new tags, and UserMatchHistory and li_sugr, which LinkedIn sets on its own domains. With enhanced matching on, it also sends email addresses hashed on your site.

Source: LinkedIn Insight Tag FAQs, linkedin.com/help.

A tag container rather than a tracking tag. Google states GTM does not collect, retain, or share information about visitors beyond aggregated tag-firing data that excludes IP and per-user identifiers, plus standard HTTP logs deleted within 14 days. The privacy question with GTM is what it deploys: the tags it fires each collect their own data, and GTM often loads early, so it can fire them before consent unless gated.

Source: Data privacy and security, support.google.com/tagmanager.

Microsoft Advertising’s Universal Event Tracking tag. It tracks on-site events, such as page views, leads and purchases, and uses cookies including MUID, _uetvid and _uetsid. With enhanced conversions turned on for a conversion goal, it sends email or phone hashed with SHA-256.

Sources: Microsoft Advertising FAQ: UET and user consent, and Enhanced conversions, learn.microsoft.com/advertising.

A session-replay and behavior tool. It captures clicks, mouse movement, scrolling, page content, and device/browser information. Hotjar automatically suppresses keystroke data on all input fields client-side, so it never reaches their servers, and by default it does not store IP addresses at rest, using a generated UUID instead. What it captures depends on your suppression settings.

Source: Data Safety, Privacy & Security, help.hotjar.com.

A session-replay and experience-analytics tool. It captures user interactions, the DOM structure of pages, and how visitors move through the site and submit forms. When Private by Default is on (standard for newer accounts, and on request for older ones), no text is captured or sent outside the browser unless explicitly allowlisted, and form inputs are masked. One documented limit: images cannot be masked on web sessions, so sensitive information shown in an image can be captured unless the element is excluded.

Source: Fullstory Private by Default, help.fullstory.com.

Pinterest’s conversion-tracking tag. It tracks standard conversion events and site activity. With Enhanced Match it sends a hashed email address to Pinterest, hashed with SHA-256 in the browser, to match site events when no Pinterest cookie is present, and supports cross-device conversions.

Source: Enable enhanced match, help.pinterest.com.

Snapchat’s advertising tag. It tracks standard events (page view, view content, add to cart, start checkout, purchase, and more). It can also send hashed email and phone, either passed by the site or picked up from forms by Snap’s Automated Matching when that toggle is on. Snap’s terms prohibit configuring the pixel to send health-related or other sensitive information.

Source: Snap Pixel FAQs, businesshelp.snapchat.com.

Criteo’s retargeting tag. It captures product views, add-to-cart actions, purchases, and site activity, and sends them to Criteo. It supports hashed email collection and cross-device tracking, and uses cookies for audience segmentation and ad delivery.

Sources: Introduction to the Criteo OneTag, help.criteo.com. Criteo privacy, criteo.com/privacy.