The tag on the page reports the visit somewhere else

Most sites do not build their own traffic measurement. They embed a script from an analytics or advertising company, and that script runs with the same access to the page as anything the site wrote itself. For a site handling intimate photographs, that arrangement means a third party can learn the visit happened even if the site's own policy is careful about the photo.

What a typical script actually sends

An analytics tag reports the page URL, a timestamp, and usually a visitor identifier, back to its own servers rather than the site's. If the URL contains anything specific - a results page with an ID in it, a path that names the tool's function - that detail travels with the report. The visitor identifier is often a cookie the analytics company set, which means the same company can, in principle, see the same visitor across every other site that embeds its script, not just this one.

This is the ordinary, intended behaviour of web analytics, not a misconfiguration. The business model of most free analytics tools depends on aggregating visits across many sites, and a site owner adding the script is agreeing to that in exchange for traffic data, usually without reading the exchange in those terms.

Why it matters more here than on a typical site

A visit to a shopping site leaking to an ad network is an ordinary annoyance. A visit to a site that scores intimate photographs leaking the same way associates a person with a specific, sensitive activity, in a system built for unrelated commercial purposes and not audited for this use case at all. Device fingerprinting is one channel a script like this can draw on to build that visitor identifier, since a third-party script has the same access to browser characteristics that any page script does.

What a consent banner does and does not cover

A cookie banner asking you to accept or reject analytics looks like a control, and in the narrow sense of the law it is one: rejecting is supposed to stop the cookie from being set. What it does not cover is server-side data the page has already sent before you clicked anything, since the initial page load, including the page URL and the fact of the request, has already reached the site's own server regardless of the banner's outcome. Some scripts also load before the banner renders, either through misconfiguration or because the site treats them as "essential" rather than "analytics" in its own categorisation, a distinction the site chooses and the visitor cannot verify from outside.

The more reliable signal is not what the banner says but what the network tab shows: which domains a page actually contacts, and whether that list changes after you reject. A site can be tested this way in under a minute, and the result is more informative than the policy text, because the text describes intent and the network traffic describes behaviour.

Ad networks are a separate, larger case

Analytics scripts measure; ad networks additionally bid. A page running programmatic advertising broadcasts the visit to dozens of bidding participants in real time, each of which receives at minimum the page URL and a device identifier, as part of how real-time bidding auctions decide which ad to show. That broadcast happens whether or not an ad is ultimately shown, and it happens to every participant in the auction, not just the winner, which is a meaningfully wider disclosure than a single analytics vendor. A site funded by this kind of advertising is making a different privacy trade than one funded by subscriptions or one-off payments, and the funding model is usually visible from whether ads appear on the page at all.

What a cookieless or first-party alternative changes

Self-hosted, first-party analytics - where the site runs its own counting rather than embedding someone else's script - keeps the traffic data inside the site's own systems instead of handing it to a third company. It does not make the data disappear, but it removes the extra party, and the extra party's own retention and use policy, from the chain. Some tools go further and run no visitor-level analytics at all, relying on server logs alone, which is a stricter but less common choice.

Reading a site's list of third-party scripts - visible in any browser's network tab, or in a cookie or "trackers" disclosure many sites now publish - tells you more about actual practice than the privacy policy's prose usually does. Rate Cock discloses its analytics setup in its privacy policy, which is the place to check before assuming a script is or is not present. Referrer headers carry a related kind of leak, disclosed to the next site you click into rather than to a script embedded on the page you are already on. Method-based tools carry the same third-party question during a session; Measure My Cock's data practices cover what it runs and what it does not. A commissioned human review has no page-tracking layer to speak of in the same sense, since the arrangement on Rate Penis is closer to a direct exchange than a tracked browsing session. Weighing a tool's tracking setup against everything else worth checking is Penis Rater's wider subject.