ObservedSeverity: ModerateConfidence: High
Product-view events sent to advertising recipients after acceptance
Product IDs and add-to-cart events were sent to Adreach Exchange and Brightpath Data Co. with cookie identifiers.
Cartwheel Market
Website · Cartwheel Retail Inc. · cartwheel.example
- Domain
- cartwheel.example
- Publisher
- Cartwheel Retail Inc.
- Platform
- Website
- Versions
- Chromium 130 (mobile profile)
- Scan date and region
- Oct 22, 2026 · US-East (Virginia)
- Consent state
- Accepted, rejected, and withdrawn — tested separately
- Scan method
- Automated browser instrumentation
- Coverage
- Full · methodology 0.9
Privacy exposure
44 / 100
Moderate measured exposure
Summary of the tested session
Across product, cart, and checkout pages, the site contacted 7 recipient companies. After rejection, 5 recipients were still contacted, none of them advertising services. A fraud-prevention script read device characteristics in every scenario.
Evidence coverage: Full
All supported scenarios tested; request contents readable for nearly all recipients. Readable request contents: 96%.
Principal findings
InferredSeverity: ModerateConfidence: Medium
Device characteristics read by a fraud-prevention script (signal)
In all three scenarios, Sentinel Verify’s script read rendering and font properties and sent a hash.
ObservedSeverity: LowerConfidence: High
Withdrawal stopped advertising requests on the next page load
After withdrawal, 5 of 7 recipients were still contacted; none were advertising services.
What information was involved
A permission alone is not treated as evidence of collection or transmission.
| Category | Status | Detail |
|---|---|---|
| Advertising and device identifiers | Observed in a transmission | Cookie identifier to 2 advertising-related recipients after acceptance. |
| Network information | Observed in a transmission | IP address visible to every contacted server. |
| Approximate or precise location | No transmission observed in the tested session | No location value observed in readable requests. |
| Browsing and interaction events | Observed in a transmission | Product views and add-to-cart events. |
| App usage and viewing events | Not assessable with this method | Not applicable to a website scan. |
| Account or contact information | Not assessable with this method | Checkout was stopped before entering contact details. |
| Sensitive contextual information | No transmission observed in the tested session | No sensitive context observed in tested pages. |
Behavior under tested privacy choices
| Scenario | Status | Recipients contacted | Companies |
|---|---|---|---|
| Consent accepted | Tested | 7 | Adreach Exchange, Brightpath Data Co., Tallymark Analytics, Sentinel Verify, Quill Consent, Orbital Cloud, Nimbus Edge |
| Consent rejected | Tested | 5 | Tallymark Analytics, Sentinel Verify, Quill Consent, Orbital Cloud, Nimbus Edge |
| Consent withdrawn | Tested | 5 | Tallymark Analytics, Sentinel Verify, Quill Consent, Orbital Cloud, Nimbus Edge |
Why this rating
Illustrative · methodology 0.9
Sensitivity of observed information9/20
Persistence and linkability of identifiers10/20
Recipient roles and dissemination evidence9/20
Behavior under tested privacy choices8/20
Disclosure–observation discrepancies8/20
Five dimensions, 0 to 20 each, sum to the score. Coverage gaps never lower a score.
What remains unknown
- Checkout was not completed; payment and account steps were not observed.
- Readable contents for 96% of requests; 2 requests used an unreadable binary format.
What you can do
Withdraw earlier consent
In testing, advertising requests stopped on the next page.
Review a recipient’s privacy information
Some recipients offer their own opt-out or deletion process.
Not a legal compliance certification or a safety guarantee. Child-audience assessment: Not assessed (separate from this rating). 7 recipient companies observed in this scan.