A tracking pixel is less powerful than a script, because it only requests an image and cannot run code. Its risk is the data in the URL: page addresses, identifiers and event details go straight to a vendor. Review what each pixel sends, which pages fire it, and who owns it.
How a pixel works
Google's Tag Manager help describes the Custom Image tag as the tag used to deploy a pixel. You enter the image URL as provided by the vendor. When the tag fires, the browser requests that URL, and the vendor's server logs the request along with its parameters, the visitor's IP address and the usual request headers.
Two details from the help page are worth noting. Use of http for the image URL is not recommended, so choose https. And Tag Manager offers cache busting, which appends a query parameter named gtmcb with a random number by default so that browsers with a cached copy still register the hit.
What can go wrong
| Issue | Why it matters |
|---|---|
| Parameters carry identifiers | The vendor receives them on every fire |
| Fires on sensitive pages | Page URLs and titles reach the vendor |
| Plain http URL | Request can be seen in transit; Google says not recommended |
| Vendor changes server behavior | A redirect can chain to another party |
| Forgotten pixel | Keeps sending after a campaign ends |
A pixel cannot read your page the way a script can. A redirect, though, can pass the request to another host, so you can end up with more recipients than you chose. Checking the network panel for redirects after the first request is quick.
Review steps
- List every Custom Image tag in the container.
- For each, copy the full URL and read every parameter. Which are fixed and which come from variables?
- Check which variables feed it. Page URL, Referrer and click variables can contain personal data. See what built-in variables can capture.
- Check triggers. Remove sensitive paths, as in which pages should not run marketing tags.
- Confirm it waits for consent where required. Use the banner test.
- Record owner, vendor and end date.
When a pixel is a good choice
Where a vendor offers both a script and a pixel, the pixel gives the vendor less access to your page. If you only need to count a conversion, a pixel with a fixed event name and no identifiers may be enough. Ask what you lose, usually richer measurement, and decide on purpose.
Contracts and notices
A pixel is still a data transfer to a third party, so it belongs in your vendor list and your privacy notice. This is not legal advice, so confirm your obligations with counsel.
Quick check
Can a pixel steal form data?
A pixel itself only requests an image, but if a tag puts form values into its URL, they reach the vendor. Review the parameters.
Why is there a gtmcb parameter in my pixel URL?
It is the default cache busting parameter Tag Manager appends so cached pixels still register.
Where Safeguard fits
Safeguard's compliance and evidence automation can help keep your vendor list and reviews in order, and dependency scanning covers shipped code. Try the free scan.
Sources
Last reviewed: 19 October 2026.
