What we found by taking things apart
Every piece here rests on something we measured or unpacked ourselves — a corpus of extensions read line by line, a set of sites sampled, a cost model run twice. The method is shown, and where a figure could not be established it says so instead of estimating.
Teardowns
What a store's third-party stack tells you
317 domains, 243 companies, and a third of them exist to identify visitors. A stack is a list of decisions someone paid for — public, checkable, and more informative than a modelled revenue figure.
How accurate are Shopify sales estimates?
No storefront publishes its sales, so every revenue figure is modelled. The category puts its own accuracy at 70–85%, and PPSPY advertises 80.5%.
The update that disables itself
Adding a permission disables an extension on every machine until each user re-approves. One published account: about 2,000 users gone in a day.
Affiliate disclosure: where it has to be
Most review sites do disclose, somewhere nobody reads. Placement is the requirement, and document order makes it measurable rather than arguable.
The Consent Gap Index 2026
How many third-party companies a page contacts before you can consent, measured across a sample of sites, with the counting rule stated.
We took apart 40 Shopify spy extensions
We unpacked forty competitors and read the code. What the all-seeing panels actually request, what they send home, and which numbers are computed rather than counted.
Sourcing and cost
Break-even CPA: the number to compute first
Margin says whether a product is viable; break-even CPA says whether you can afford to advertise it. At €14.95 it leaves €6.88 a customer; at €39.95, €26.81.
Rate beats the point estimate
Every research tool gives you a number; none gives you the derivative. 400 a month is a gift after 200 and a warning after 900, and the figure cannot tell you which.
The de minimis cliff
Customs duty is charged on the consignment, not the unit, so crossing €150 applies it to every item at once. 35 units to 40 raised the landed cost 9.6% each.
Reference and standards
Blocking AI crawlers: what robots.txt can do
A sign on a door, not a lock. Silence is permission, the rules for one agent are the union of every group naming it, and X-Robots-Tag is invisible in the source.
Product schema: declared vs shown
Every page makes two claims and machines read the second. Two Product nodes disagreeing, a stale price, availability hardcoded to InStock — the failures that validate cleanly.
Comparisons
Shopify spy extensions compared
What each one can actually read, what it asks permission for, and which figures are modelled rather than counted.
Meta Ad Library tools compared
Permissions, what each can genuinely read from the page, and where the archives come from.
Reference
Alongside the writing there are maintained reference sets, each built from the same corpus: third-party companies seen on real sites, platforms and frameworks, consent platforms, and what differs by top-level domain.