A Complete Pigeon Report for a Fictional Florist.

1. What matters

The short version

1. 6 Before anyone clicked anything, your site contacted 6 outside companies that run advertising, analytics, recording, chat, media or similar tools.
2. 4 of them are not named in your privacy policy. 2 of these are described only in general terms.
3. 5 of them were still contacted after we clicked "Reject all" on your cookie banner.
4. Email SPF record found. No DMARC record found.

Counts describe this example. Every website is different.

Start here

1. 1. Make Reject stop Ad Pixel

   After we clicked "Reject all", your site still contacted Ad Platform through Ad Pixel.

2. 2. Load the video only when someone clicks

   Your video contacts Video Platform as soon as Home and Booking load, before anyone chooses to use it.

3. 3. Load the map only when someone clicks

   Your map contacts Map Provider as soon as Contact loads, before anyone chooses to use it.

2. Your outside companies

These are the outside companies your site contacted before anyone clicked anything, in the order we would look at them.

Also contacted: services that help your site work

These services deliver fonts or files, take payments, run security checks or run your cookie banner. We list them for completeness and do not count them above.

We did not see any.

Your site platform

We did not identify a hosted site platform.

Addresses we could not identify

None. We matched every outside address we saw to a known company.

3. Page by page

4. Your cookie banner and the Reject test

• We saw a cookie message on Home. We could not tell which product runs it.
• Its first screen had a button labeled "Reject all". In a separate new browser, we clicked it once and then loaded the pages again.
• After the click, the banner closed.
• After Reject, 5 of the 6 outside companies we saw before any click were still contacted.
• Ad Platform: still contacted on Home, Wedding flowers, Contact, Booking and About through Ad Pixel.
• Chat Provider: still contacted on Home, Wedding flowers, Contact, Booking and About through Chat Widget.
• Video Platform: still contacted on Home and Booking through Video Player.
• Map Provider: still contacted on Contact through Map Embed.
• Scheduling Provider: still contacted on Booking through Booking Calendar.
• Analytics Provider: not contacted on the pages we checked after Reject.
• Before any click, the browser held 3 cookies from outside companies and 3 from your own site.
• After Reject, 1 new cookie from outside companies was set: bk_session.

5. Your policies compared

What we read

"Named" means the name appears in the text. We do not judge what the policy says about it.

The words we matched

• Video Platform: ...Some of our pages include embedded content from other websites, such as our workshop video and a map to the shop...
• Map Provider: ...Some of our pages include embedded content from other websites, such as our workshop video and a map to the shop...
• Scheduling Provider: ...Workshop bookings are handled by Scheduling Provider, which receives the name, email address and workshop you choose when you book...
• Analytics Provider: ...To improve our website, we use Analytics Provider to count visits and see which pages people find most useful...

6. Email settings for your domain

These are public DNS settings for fernandfinch.example. They help mail servers that receive email from your domain tell it apart from forged email. We only read them. We did not send any email.

7. WordPress public user list

Your site's public WordPress user list (fernandfinch.example/wp-json/wp/v2/users) listed 2 accounts. We counted them and did not record any names. Many site owners limit this list so account names are not public.

8. What to do

Each item says what we saw, what you could do and what changes if you do it. We list them in the order we would look at them. You or your web developer can make these changes, and you decide which ones suit your business.

9. Vendor list for your lawyer or advisor

This list records facts from our visits on September 9, 2026. It is not legal advice. It shows which outside companies your site contacted, when, and whether your policies mention them, so that your lawyer or advisor can review them.

10. How we checked and what we did not check

How we checked

• When: September 9, 2026 at 10:14 AM Eastern Daylight Time to September 9, 2026 at 10:31 AM Eastern Daylight Time.
• Where: a computer in the United States, on an ordinary internet connection.
• Browser: Microsoft Edge 154.0.4258.37, run automatically without a window. Each visit used a new, empty browser profile: no saved cookies, no sign-ins and no extensions. We turned off the browser's own tracking protection so we could see everything the pages asked it to load. Other browsers and settings can block some of these connections.
• Screen: 1440 by 900 pixels, like a laptop. We did not check phone layouts.
• Pages: Home, Wedding flowers, Contact, Booking and About. We chose them from links on your homepage, and included Wedding flowers at your request.
• First visit: for each page, we loaded it once, scrolled down it in steps and waited 10 seconds. We did not click, type, hover, sign in or submit anything.
• Second visit: in another new, empty browser we loaded your homepage, waited for the banner and clicked "Reject all" once. That was the only click in either visit. We then waited 5 seconds and loaded each page again the same way.
• Policies: we read your privacy policy on September 9, 2026. We compared them with the names, web addresses and cookie names of the companies we saw, using our list of 316 known tools (version 2026.09.01).
• Email: we looked up public DNS records for fernandfinch.example: SPF, DMARC, mail servers, and DKIM keys under 31 common names.
• WordPress: we requested the public user list once and counted the accounts. We did not record any names.
• Pace: we loaded one page at a time with a pause between pages, 12 page loads in total.

What we did not check

• Pages other than those listed above.
• What happens after clicking Accept, opening banner settings, signing in, adding to a cart, booking or submitting a form.
• How your site behaves for visitors in other states or countries. Banners and tools can change by location.
• Phone and tablet layouts, and apps.
• Anything your web server, tag server or other services send to other companies behind the scenes. A browser cannot see that.
• What each company does with information after receiving it, and the settings inside your accounts with those companies.
• Whether any law applies, or what your policies should say. Those are questions for your lawyer.
• Photos with location data, forgotten PDFs and other old documents, and domain registration records. This version of the report does not include them.
• How well your site resists misuse. We did not test for weaknesses and did not look for hidden pages.
• Anything about individual people.

Good to know

• Results can change between visits. Ads, experiments and tag managers can load different tools at different times.
• Our list of known tools is built from each company's own public documentation. An address we did not recognize is listed as unidentified rather than guessed.
• Times are measured from when each page started loading and are approximate.

11. Evidence

A. Files

In a real report this table also gives each file's size and the first 16 characters of its SHA-256 hash, and a last line gives the hash of report.json, so you can tell whether anything changed. Fern & Finch is fictional, so there are no files to hash.

B. Requests to outside addresses

A real report prints one table for each page and visit. The other 8 are summarized here, and the full log is in evidence/requests.csv.

• Wedding flowers, first visit: requests A-027 to A-048, 6 of them to outside addresses.
• Contact, first visit: requests A-049 to A-071, 9 of them to outside addresses.
• Booking, first visit: requests A-072 to A-098, 10 of them to outside addresses.
• About, first visit: requests A-099 to A-117, 6 of them to outside addresses.
• Wedding flowers, after Reject: requests B-025 to B-044, 4 of them to outside addresses.
• Contact, after Reject: requests B-045 to B-065, 7 of them to outside addresses.
• Booking, after Reject: requests B-066 to B-090, 8 of them to outside addresses.
• About, after Reject: requests B-091 to B-107, 4 of them to outside addresses.

C. Cookies

D. Screenshots

• First screen of Home before any click, 10:14 AM.
• First screen of Wedding flowers before any click, 10:15 AM.
• First screen of Contact before any click, 10:16 AM.
• First screen of Booking before any click, 10:17 AM.
• First screen of About before any click, 10:18 AM.
• Your banner before we clicked, 10:23 AM.
• The page after we clicked "Reject all", 10:24 AM.

In a real report these are images, and the full-size files are in evidence/screenshots. Fern & Finch is fictional, so they are described in words here.

E. Policy copies

F. DNS answers

G. Clicks

12. Plain-language guide