# Tracker inventory: what is actually running on your site

> What a tracker inventory is, why it matters, how trackers map to the four consent categories, and how to keep the inventory honest as your site changes.

Author: OptinStack Team  
Published: 2026-06-27  
Page: https://optinstack.com/blog/tracker-inventory-what-is-running-on-your-site  
Markdown: https://optinstack.com/llms.md/blog/tracker-inventory-what-is-running-on-your-site

You cannot manage what you have not inventoried\. Before a consent banner can block or release the right trackers, you have to know what is actually running on your site\. Most teams are surprised the first time they scan their pages and find trackers they did not author, set by plugins, tag managers, or third\-party widgets\. This post explains what a tracker inventory is, why it matters, and how to keep it honest as your site changes\.

## What a tracker inventory is

A tracker inventory is a living list of every script, pixel, iframe, and storage item on your site that reads or writes visitor data\. Each entry captures what the tracker is, where it comes from, what category it belongs to \(necessary, analytics, marketing, preferences\), and which pages it appears on\. The point is to turn a hidden runtime reality into something you can see, classify, and control\.

## Why it matters

- Without an inventory, enforcement is guesswork\. You cannot block a tracker by category if you do not know it exists\.
- Privacy laws expect your notices to match reality\. If your banner lists six trackers and the page loads nine, the notice is inaccurate\.
- Inventories drift\. A marketing plugin added last quarter can silently introduce new trackers that nobody scoped for consent\.
- During an audit, an inventory is the difference between an answer and a guess\.

> **Tip:** A tracker inventory is not a one-time export. Pages change, plugins update, and tags get added through Google Tag Manager without a code review. Schedule re-scans so the inventory reflects the site as it is today, not as it was at launch.

## How trackers get categorized

Each tracker maps to one of a small set of fixed consent categories\. The category decides when the tracker may load and whether it is gated behind a consent choice\.

*How trackers map to the four fixed consent categories*

| Category | Typical trackers | Consent gate |
| --- | --- | --- |
| Necessary | Session, cart, security, load balancer | Never gated |
| Analytics | GA4, measurement pixels, error tracking | Varies by mode and region |
| Marketing | Ad pixels, retargeting, conversion trackers | Varies by mode and region |
| Preferences | Language, theme, UI personalization | Varies by mode and region |

> **Warning:** Necessary is an invariant. A tracker is necessary only if the site cannot function without it. Convenience tracking, even first-party analytics, does not qualify, and bundling it into necessary undermines the consent model.

## How a scan works

A scan loads the page the way a visitor would, observes which scripts, iframes, and storage items appear, and maps each to a known tracker definition\. The result is a per\-page list that you review, approve, and publish as your declaration\. The key is that the scan reflects the runtime, not just the source code, because tag managers can inject trackers dynamically\.

## Keeping the inventory honest

- Scan after any release that touches marketing, analytics, or third\-party embeds\.
- Treat new trackers as a review step, not an automatic publish\. Someone should classify them\.
- Re\-scan on a schedule, weekly or monthly, to catch drift between releases\.
- Make the inventory the single source your banner reads from, so the notice and the enforcement always agree\.

A tracker inventory turns the invisible part of your site into something you can govern\. Once you know what is running and why, the rest of consent work, notice, enforcement, and records, has a solid foundation to stand on\.