How Web Tracking Actually Works: Pixels, Cookies & Hits

Most tracking problems get a lot easier to debug once you understand what's actually happening under the hood: how a page load turns into a "hit," how a tool recognizes a returning visitor, and why two analytics tools never quite agree. This is the mental model the rest of GTM builds on.

A page load is a sequence, and timing matters

When a browser opens a page it requests the HTML, parses it into the DOM, and runs scripts as it goes. GTM loads asynchronously near the top and fires a sequence of built-in events as the page progresses:

• gtm.js, the container has loaded and can start firing.
• gtm.dom, the DOM is ready (the DOM Ready trigger).
• gtm.load, the window has fully loaded, images and all.

A tag that reads page content must fire after that content exists. Choosing the right moment is half of getting a tag to work, and the source of many "it's undefined" bugs.

How a tag sends data: the "hit"

A tag's job is to send a request to a vendor with some parameters. Under the hood it's a tracking pixel, a fetch, or a sendBeacon, but the idea is always the same: encode the data into a request and send it to a collection endpoint.

https://www.google-analytics.com/g/collect
  ?v=2&tid=G-XXXX&en=purchase&ep.currency=USD&epn.value=49

How tools recognize a visitor

To attribute a series of hits to the same person, a tool stores an identifier in a first-party cookie. GA4 keeps a client id in the _ga cookie and attaches it to every hit.

• Client id: identifies a browser, stored in a cookie.
• Session: a time-bounded group of activity that ends after inactivity.
• User id: your own logged-in identifier, which can stitch sessions across devices.

Because this rests on cookies, anything that clears or shortens them, privacy settings, different devices, incognito, fragments the picture. That's the root cause of many "why are users inflated?" questions.

Why two tools never agree

Attribution decides which marketing touchpoint gets credit for a conversion. Two choices drive it: the lookback window (how far back to consider touches) and the model (how to split credit). A click-based ad platform and a session-based analytics tool use different windows and models, so their conversion counts legitimately differ. That's expected, not a bug.

Why tracking breaks

Tracking is fragile because it depends on the browser cooperating. The usual suspects:

• Ad and tracking blockers that stop vendor requests entirely.
• Browser privacy features (ITP, ETP) that shorten or clear cookies.
• Consent denial, so tags hold or run cookieless.
• Single-page apps that change the URL without a real page load.
• Tags firing before the data they need exists (race conditions).

The resilient answers, server-side tagging, first-party data, robust triggers, firing on confirmed events, all follow from understanding these mechanics.