Cartwheel Market

Website · Cartwheel Retail Inc. · cartwheel.example

Domain: cartwheel.example
Publisher: Cartwheel Retail Inc.
Platform: Website
Versions: Chromium 130 (mobile profile)
Scan date and region: Oct 22, 2026 · US-East (Virginia)
Consent state: Accepted, rejected, and withdrawn — tested separately
Scan method: Automated browser instrumentation
Coverage: Full · methodology 0.9

Findings and evidence (3)

Observed 2
Inferred 1

Evidence records show the request as captured, with identifiers and tokens redacted. Findings labeled Unknown state what could not be established; they are not findings of absence.

ObservedSeverity: ModerateConfidence: High

Product-view events sent to advertising recipients after acceptance

Product IDs and add-to-cart events were sent to Adreach Exchange and Brightpath Data Co. with cookie identifiers.

Why it matters: Shopping interests can be used for ad targeting on other sites.
Conditions: Consent accepted · US-East
Confidence basis: Readable contents, repeated sessions.
Limits of this finding: Downstream use unknown.
What you can do: Reject optional cookies.

Evidence records (1)

R-CW-0120Consent acceptedt+00:00:11
GET https://pixel.brightpath.example/p
Redacted request parameters for R-CW-0120
Parameter Value
ev add_to_cart
sku CW-55102
uid bp_••••(redacted)

Redacted request parameters for R-CW-0120
Parameter	Value
ev	add_to_cart
sku	CW-55102
uid	bp_••••(redacted)

InferredSeverity: ModerateConfidence: Medium

Device characteristics read by a fraud-prevention script (signal)

In all three scenarios, Sentinel Verify’s script read rendering and font properties and sent a hash.

Why it matters: These signals are consistent with device fingerprinting, which can persist across cookie clearing. They are presented as signals, not a conclusion.
Conditions: All scenarios · US-East
Confidence basis: Premises: script read canvas, fonts, and screen properties (observed); values were hashed and sent (observed). Purpose of building a device fingerprint is inferred.
Limits of this finding: Fraud prevention is a stated purpose; whether the hash is reused elsewhere is unknown.

Evidence records (1)

R-CW-0201Consent rejectedt+00:00:03
POST https://api.sentinelverify.example/v3/s
Redacted request parameters for R-CW-0201
Parameter Value
dh a81f••••(redacted hash)
ctx checkout

Redacted request parameters for R-CW-0201
Parameter	Value
dh	a81f••••(redacted hash)
ctx	checkout

ObservedSeverity: LowerConfidence: High

Withdrawal stopped advertising requests on the next page load

After withdrawal, 5 of 7 recipients were still contacted; none were advertising services.

Why it matters: Privacy choice took effect promptly.
Conditions: Consent withdrawn · US-East
Confidence basis: Repeated sessions.

Evidence records (0)

No evidence record: this finding states what was not established.