Why Does Every Website Want to Know So Much About You?

On 8 November 2026, we opened each public homepage in a fresh desktop browser session from South Africa. We watched the requests from navigation through 12 seconds after Chrome’s initial page load milestone. We also tested what happened after a cookie choice where we could verify one.

We looked for successful responses at specific Google Analytics, Meta Pixel and Microsoft Clarity measurement endpoints. “None observed” means no successful response at those endpoints in that window. Valo publishes this article. We ran the same check on our homepage after pausing optional analytics.

On Vodacom, we saw no measurement responses at the endpoints we checked on the first visit or after rejecting non-essential cookies. In a separate session, we observed responses from Meta Pixel and Microsoft Clarity during and just after clicking Accept all Cookies.

After accepting on The Citizen, we reopened Privacy and chose Reject All. When we returned to the homepage, Google Analytics responded to requests carrying a signal that analytics storage was denied. A measurement request and a cookie write tell you different things.

The comparison covers four retailers, three news publishers, two mobile networks and one bank, with Valo tested separately. The evidence captures visible controls, browser responses and selected cookie names for those pages and sessions. What happens on other pages, how a recipient uses the data and what lawful basis applies sit outside that view.

A cookie can help a shop remember the chips you put in your basket. Another can help it measure how many people get as far as checkout. The question to ask is what job each one does.

South Africa’s Protection of Personal Information Act, or POPIA, requires a lawful reason to use personal information, a specific purpose for collecting it, and limits on how much information a business uses for that purpose. If a business relies on your consent, you can withdraw it.

If you build websites, open your homepage in a fresh browser session with the Network panel open. Watch the requests before making a choice, then try the choices the visitor actually sees. Return to the page and check whether you can change your mind.

A driver needs somewhere to deliver. If the shop asks for your ID number to bring you the same bag of chips, that field deserves an explanation. POPIA generally requires businesses to explain why they are collecting personal information, whether supplying it is voluntary or mandatory, and what happens if you leave it out.

An order update helps get supper to your door. A Friday special serves a marketing purpose. For unsolicited electronic promotions, a business generally needs consent or must meet the conditions for marketing its own similar products or services to an existing customer. Those conditions include a free, easy way to object when it collects your details and in later promotions if you haven’t already opted out.

The order can outlast the chips. A shop may need the invoice for its accounts. POPIA generally limits retention to the time needed for the purpose, with exceptions such as a legal recordkeeping duty. It also sets conditions for transfers to recipients abroad. The privacy notice is a place to look for who may handle your details and how they are protected.

Start with a plain question. “Do you hold personal information about me, and how can I see it?” With adequate proof of identity, you can ask for confirmation free of charge and request access. You can also request a correction or deletion on the grounds POPIA provides.

If you need a private company’s record to exercise or protect a right, its PAIA manual explains how to make a formal request. At Valo, our privacy notice explains what we collect when you contact us and who handles our hosting and email. Our PAIA manual gives you the Information Officer’s contact details and links to the official Form 02.