EN
A person typing on a laptop at a wooden desk, with Google Analytics and Meta icons overlaid and servers in the background.

Digital bond · Essay

How they track you (I): what Google Analytics and the Meta Pixel really collect

October 2, 2026 · 7 min read

What a Google Analytics 4 tag and the Meta Pixel really collect, told through both companies' own official documentation and without adjectives.

Concept sheet →

When a website shows you a cookie banner, it almost never explains what’s behind it. This is the first of four pieces meant to do exactly that. Today we only describe: what two of the most widespread tools, Google Analytics 4 (GA4) and the Meta Pixel, actually collect, as documented by Google and Meta themselves. What happens to that data afterward is for a future piece.

A note on method: we quote what the official pages say and flag what they don’t say. Where the documentation doesn’t specify something, we don’t fill in the gap. The main Meta page we cite shows, in its Spanish-language version, a last update of 2023; the English version shows no date. We give both in the sources.

What a tracking tag is

A tag is a snippet of code that a website’s owner pastes into its pages. Every time you load a page or do something on it, that code sends a message to the servers of the company that owns the tool. You don’t see the message; the website’s owner sees the result in a dashboard.

Meta describes it this way: the Pixel is «a snippet of JavaScript code that allows you to track visitor activity on your website». Its results are used, Meta says, to measure ad effectiveness, build custom audiences for ad targeting, and analyze conversion funnels.

What Google Analytics 4 collects

When a website uses GA4, its tag tells Google about certain things you do on it. According to Google, for every visit it logs, without the website needing to configure anything further:

  • that it’s your first visit and when your session starts;
  • that the page is in the foreground for at least one second;
  • the language, address, and title of the page, which page you came from, and your screen resolution;
  • a client identifier and a session identifier.

Google also documents (in the Spanish-language version of its help page) that these events are logged by default through “enhanced measurement”:

  • every page you load;
  • how far you scroll, when you reach 90% of the page;
  • clicks on links that take you away from the site;
  • file downloads (PDF, documents, audio, video);
  • what you search for within the site;
  • how much of an embedded YouTube video you watch (10%, 25%, 50%, and 75%);
  • when you start filling in a form and when you submit it.

What GA4 logs, according to Google’s official documentation, with “enhanced measurement” turned on. Tap the image to see it full size.

How does it know you’re the same person when you come back? With two cookies, according to Google: _ga, used «to distinguish users» (para distinguir usuarios), and _ga_<id>, which stores session state. Both expire by default after 2 years, although browsers can shorten that (down to 400 days in Chrome and 7 in Safari if you don’t return). With _ga, the website knows you’re the same visitor as long as the cookie stays in your browser; that’s our own reading — Google only states that it serves to distinguish users.

There’s one more option: User-ID. If the website enables it, it can assign you its own identifier when you log in. According to Google, it’s used to tie your activity together across sessions, devices, and platforms, and the dashboard lets someone view a specific user’s activity.

What we cannot claim based on what we reviewed: whether enhanced measurement ships turned on by default or is switched on by whoever configures the website (Google says these events are logged through it, not that the switch is on by default), and whether GA4 uses browser fingerprinting techniques or not (the Google pages we reviewed don’t document it either way).

What the Meta Pixel collects

According to Meta’s documentation, the Pixel can collect:

  • whatever is generally present in HTTP headers, the data that travels in any web request. Meta says this can include the IP address, browser information, the page’s location, the referring document, where you came from, and the person using the site. The page doesn’t explain how that person is determined, and we don’t fill that gap in;
  • the Pixel ID and Facebook cookies;
  • the buttons you click, their labels, and the pages you land on;
  • the names of a form’s fields (for example, “email” or “address”). Field values are only captured if the website includes them through Advanced Matching or optional values («We don’t capture field values unless you include them as part of Advanced Matching or optional values»).

What the Meta Pixel collects, according to its official documentation, from the browser and from the server (Conversions API). Tap the image to see it full size.

Advanced Matching is the feature that lets a website send Meta your data to associate it with what you do there; it can also be switched on from Meta’s dashboard (Events Manager). The data Meta lists are: email, first name, last name, phone, gender, date of birth, city, state/province, postal code, country, and a website-specific identifier (a membership number, for instance). The documentation doesn’t say this list is exhaustive.

This data is sent as a «hash» (SHA-256): an operation that turns the email into an unreadable string with no way back. That doesn’t make it anonymous: the same email always produces the same string, so it still works for recognizing the same person. The GDPR treats this “pseudonymized” data as personal data as long as it can be attributed to someone using additional information (Art. 4(5) and Recital 26). This sentence is our own reading, not Meta’s.

Meta has another channel, the Conversions API: events don’t leave your browser — they come from the website’s server instead. According to Meta, this channel sends, unhashed, your IP address, browser type, and the _fbp and _fbc cookies. According to Meta, the first stores a browser identifier (its format includes a random number) and the second, the identifier of a click on a Meta ad. Email, phone, name, and the rest of the personal data on the list are sent hashed; the website’s own identifier (external_id) is only recommended by Meta to be hashed, not required.

If the same event arrives through both channels, Meta avoids double-counting it by comparing its name and its identifier. If they arrive less than five minutes apart, it gives priority to the browser event.

What’s left unsaid

Up to this point, facts: what is collected and through what mechanism. There are two things this piece does not claim:

  • We don’t claim that every website using these tools sends all of these fields. Many of them depend on the owner switching them on.
  • We don’t yet say whether that’s good or bad. A visit counter and a profile that follows you from site to site are different things, and the difference matters. The mechanics of that boundary are what comes next.

It’s the same stance that guides the sister piece on PISA 2025 and AI in the classroom: data and evidence in hand before drawing conclusions, in one case about commercial tracking, in the other about AI use in schools.

We’ll see what’s done with this data, and why a system that only measures can end up intervening in what you do — in the next piece of the Digital bond hub.

Sources

Checked on 2026-10-13.