Validate a pixel

Ten reasons

Why bother

• Broken pixels return 200. A malformed conversion event is accepted and nothing reports it wrong. You find out at month-end reconciliation, if at all.
• Every endpoint wants a different clock. Meta takes seconds, LinkedIn milliseconds, GA4 microseconds, Amplitude milliseconds, PostHog and Braze ISO 8601. Send the wrong unit and the event is accepted, dated 1970.
• A purchase with no value reports no revenue. Meta and GA4 both document value and currency as required for purchase events. Neither rejects the event when they are missing.
• Hashing goes wrong in both directions. A raw email in user_data is a privacy incident. A hashed IP address makes the event unmatchable. On the wire they look the same.
• gdpr_consent=1 passes a format check. It is valid base64. Only decoding the version field shows it carries no consent at all, which is legal exposure behind a green response.
• Server-side has no console. Conversion APIs are raw JSON posted from your backend. No network tab, no browser warning, no consent tool to object.
• Findings cite the vendor's own documentation. With the URL. That turns "I think the tag is wrong" into a ticket the other team can act on.
• It runs before launch. A terminal, CI, an MCP server for agents, an npm package, or this page. Catching a defect at QA costs minutes; catching it after spend costs the campaign.
• Vendor rules only fire on vendor endpoints. No noise on an endpoint it does not understand, and no invented rules either. Unknown hosts get attribution, not findings.
• One tool, not seven vendor debuggers. Browser pixels, conversion APIs, and the analytics tier, with the same output and the same exit codes across all of them.