Debug Criteo in Chrome DevTools

What Criteo traffic looks like

Criteo's OneTag loads once, then fans out to a family of purpose-specific hosts: event beacons, user syncing, bidding, and retargeting widgets.

Endpoint pattern

OneTag from static.criteo.net; event beacons to the criteo.com event endpoints (including .eu.criteo.com regional hosts); user syncing on gum.criteo.com and dis.criteo.com; header-bidding traffic on bidder.criteo.com; dynamic retargeting widgets on sslwidget.criteo.com and dynamic.criteo.com

Transport

A single page view often produces several requests across these hosts; the gum.criteo.com sync calls are cookie-matching traffic, not commerce events (worth distinguishing before concluding an event fired twice)

Key parameters

a Criteo account (partner) ID · e event name (viewHome, viewList, viewItem, viewBasket, trackTransaction) · sc JSON-encoded identity data, typically a hashed email slot · fu / tld the full page URL and top-level domain the tag saw · deduplication, new_customer, transactionid transaction attribution flags on purchase events

E-commerce

item / productid: a JSON array of products with id, price, quantity

Debugging Criteo with Event Watcher

• Matches all of the hosts above and applies its dedicated Criteo parser: decoded event names instead of raw query strings.
• The detail view groups the hit: User & Site (site type, retailerVisitorId, customerId, the parsed sc identity object), Transaction with deduplication flags, an E-Commerce items table with product IDs, prices, and quantities, and an Identity group that unpacks external_advids per provider.
• The Cookies section shows what Criteo set and sent on each request.
• The Script Tree view answers whether OneTag was loaded by the site or injected through a tag manager.

Criteo and consent

Event Watcher checks Criteo against marketing consent.

Because OneTag is usually deployed through GTM behind a marketing trigger, the common failure is the trigger, not the tag: a viewItem beacon before the CMP records a marketing grant is flagged pre-consent, and the violations counter totals them.

Watch the sync hosts too: gum.criteo.com firing on a consent-denied page is exactly the kind of finding a DPO asks about. The audit all tracking pixels guide covers the systematic version of that check.

Common debugging scenarios

• Transaction fires but Criteo reports no sales. Open the trackTransaction event and check the E-Commerce section. Missing id or a mismatched transactionid breaks attribution and deduplication.
• Duplicate purchase events. Group by Event Name and compare the deduplication flag across the two hits; one usually comes from GTM and one from hardcoded OneTag.
• Criteo fires on consent-denied sessions. Deny marketing in the CMP, reload, and check whether any criteo.com request still appears with a denied or pre-consent badge.
• Which script loaded OneTag? Switch to Script Tree. Retail sites frequently load Criteo both from GTM and from an affiliate wrapper, doubling every event.
• Product IDs do not match the feed. The parsed items table shows the exact item payload sent, so you can compare IDs against the catalog feed without decoding JSON by hand.