Pixels and tags have been around for years. What has changed is where the data goes. Ad platforms and AI vendors now use site activity to train models, target audiences and drive automated decisions, so the question in a privacy case is often what left the site, and where it ended up. At the same time, automated tools let claimants spot suspect sites in bulk, so defendants need a defensible forensic baseline quickly. And AI chat widgets embedded on websites have become a new tracking surface of their own: their conversations can be captured or shared with third parties too.
Pixel, cookie and session-tracking claims turn on a technical question: what actually left a visitor's browser, when, and to whom. Right Forensics answers it with a repeatable, documented browser collection that preserves every request as evidence and ties each observation to the artifact behind it.
We run controlled, instrumented browser sessions against a website and record everything the site sends to outside parties. Each session follows a defined path through the site, such as browsing service pages, using a search box, playing a video, filling out a form, or working in a logged-in area, and is repeated under a matrix of test conditions:
For every request that leaves the browser we identify the recipient and its operator, and what the request carried: page addresses and titles, event names, identifiers, cookies, and any test-persona details such as a name, email address or search term. Every session uses a fictitious test persona, never a real person. We look for persona data in plain form, in common encodings and in hashed forms used by ad platforms.
Planned with counsel. We agree on the pages, journeys, conditions and persona details that matter for the claims or questions at issue, and record that plan as part of the evidence.
A fresh browser every time. Each run starts from a clean browser with empty storage, so one test cannot contaminate another.
Everything preserved. For each run we keep the full network capture, every request with its headers and content, cookie snapshots before and after each step, a screenshot for each step, a video of the session and the browser console log.
Sealed as it is collected. Files are written read-only and hashed as each run finishes. Each run is recorded in an append-only custody log in which every entry is linked to the one before it, so any later change would be detectable. The full collection is re-verified before reporting.
Observations, not conclusions. Our reports state what was observed and flag items for counsel's review. We do not characterize conduct as lawful or unlawful; that is for counsel and the court.
Limits disclosed. Automated browsers, datacenter network addresses and emulated devices can be treated differently by some sites and vendors. A scan also shows what left the browser, not what a recipient later did with the data, and not server-side tagging. We say so in every report.
A written memorandum with key points, the test design, findings by topic, evidence integrity details, limitations, and the data sources not examined.
An analysis workbook with recipients, transmissions, disclosures, cookies, review flags, a condition-by-condition comparison and a data dictionary.
Traceable evidence IDs. Every reported transmission carries an ID that leads back to the underlying request, the network capture, the step screenshot and the custody entry that sealed it.
The preserved collection, with a hash manifest and custody log, which a qualified examiner can independently re-verify.
Flat data files for counsel's or an expert's own analysis.
No. Those tools show a snapshot of one visit. We run a defined test plan across many conditions, preserve the raw evidence, and document chain of custody so the results can be reproduced and checked.
Yes. Using test accounts and fictitious persona data, we can work through logins, forms, searches, video players and downloads. Whether a form is actually submitted is agreed with counsel in advance.
We run the same journeys with and without the GPC signal and compare what was sent to each recipient under each consent choice.
No. We report observations and flag items for review. Legal conclusions belong to counsel.
A scan reflects the site when it is collected. Earlier behavior may sometimes be inferred from other sources, but we will be clear about the difference.
Need to know what a website actually shares, and to prove it? Tell us about the site and the questions in your matter, and we'll design a scan around them.
START A CONVERSATION