NT Analyzer Case Study

Luxury Hospitality Website – “Aurelia Regent”

Fictional brand: Aurelia Regent– a global ultra-luxury resort operator offering high-end vacation suites and bespoke experiences.

Executive Summary: Key Findings at a Glance

NT Analyzer testing revealed that Aurelia Regent’s marketing website operates a data-intensive advertising ecosystem far more extensive than leadership anticipated—with high-intent travel browsing data reaching dozens of third-party vendors and significant gaps between consent controls and actual network behavior.

Finding Theme & Key Insight

Advertising Density

Identified 70+ third-party endpoints receiving high-intent travel browsing data, including suite preferences, bespoke experiences, and quote submissions

Identity Graph Exposure

Found persistent person IDs shared between Neustar, PebblePost, and The Trade Desk—enabling offline direct-mail retargeting from website visits

Hashed Contact Data

Detected hashed email addresses from information requests flowing to programmatic advertising platforms, potentially constituting “sale/share” under CCPA

Profiling Signals

Uncovered segment labels like “ultra_lux_suite_intender” and “high_value_suite” being assigned and transmitted to personalization vendors

Consent Implementation Gaps

Observed core ad-tech vendors receiving identifiers even in “Reject All” and “Do Not Sell/Share” states

1. Background & Objectives

Client: Aurelia Regent (fictional)
Platform: Public website (desktop & mobile web) – aureliaregent.com

Engagement Goal: Evaluate data flows from Aurelia’s marketing and booking website to understand:

What categories of personal and sensitive data are transmitted to first-party vs. third-party endpoints.
How extensive the advertising & analytics ecosystem is, particularly identity and audience vendors.
Whether cookie consent and “Do Not Sell/Share” choices appear to influence downstream tracking behavior.
Where risks or “pressure points” may exist under U.S. state privacy laws (e.g., sale/share, targeted advertising, profiling, sensitive data) and global regimes, without making legal conclusions.

Aurelia’s leadership believed they were running a fairly “standard” analytics stack and wanted an independent network-traffic assessment to either validate that view or highlight areas for remediation.

2. NT Analyzer Testing Setup

NT Analyzer testing was conducted on a staging-like production build of aureliaregent.com using a controlled browser environment routed through the NT Analyzer client-side proxy.

2.1 Key User Journeys

The test plan focused on flows that are most likely to generate high-intent or sensitive data, including:

Homepage exploration & itinerary browsing
- Viewing suite options, destination pages, pricing grids, and FAQs.
Quote & lead-generation forms
- “Request More Information,” “Request a Call,” and “Request a Quote” flows.
Account-related interactions (non-authenticated)
- Newsletter sign-up, waitlist interest, loyalty-program page.
Cookie banner & consent flows
- “Accept All,” “Reject All,” and “Manage Preferences” interactions.
“Do Not Sell/Share My Personal Information” / privacy rights interface
- Where exposed under “Your Privacy Choices.”

2.2 Artifacts Collected

For each flow, NT Analyzer generated and analyzed:

Overview file – host list per test file / scenario.
Data Detections file – curated table of potentially sensitive fields.
Key-Value Dump – detailed cookie, query, header, and payload parameters.
Host Mapping Layer – AI-enriched mapping: host → company → role.
Composed Report – unified, narrative report plus structured tables.

3. Methodology

Client-side network capture
- NT Analyzer proxies the browser/device and records all outbound requests during scripted and exploratory test sessions.
- Only traffic leaving the browser is observed — there is no server-to-server visibility.
Automated artifact generation
- The tool generates:
  - A host Overview (who is receiving traffic and in which flows).
  - Data Detections highlighting potential PII/sensitive values in requests.
  - A Key-Value Dump of cookies, headers, query parameters, and payloads.
- These are normalized into CSV/Excel for structured analysis.
Host intelligence enrichment
- All unique hosts are passed through an AI-driven host mapper to identify:
  - Likely company name (e.g., “The Trade Desk,” “Meta,” “Neustar”).
  - Role (e.g., analytics, ad-tech, CDN, session replay, personalization).
  - Any ambiguity notes.

AI-assisted analysis modules
- For each artifact, a dedicated NT Analyzer module produces:
  - A polished narrative.
  - A distilled issues table (e.g., “Overview – Noteworthy Hosts and Issues”; “Detections – Noteworthy Transmissions”).
Final composition
- The Composer module merges all narratives and tables into a single Aurelia Regent NT Analyzer Privacy Assessment Report, with:
  - Introduction, Methodology, Scope.
  - Overview / Host Ecosystem section.
  - Data Detections section.
  - Key-Value / Identifier Analysis.
  - Key Points & Conclusion.

4. Technical Findings by Module

4.1 Overview / Third-Party Ecosystem

The Overview file, enriched with host intelligence, showed that Aurelia’s site relied on:

a) Core first-party & infrastructure

aureliaregent.com and subdomains (main site, assets, booking front-end).
CDN and asset hosts (e.g., static.aurelia-cdn.com or generic CDN providers).
First-party analytics endpoints (e.g., Adobe or in-house data-collection servers).

These hosts were expected and necessary to deliver site functionality, including content, images, and booking UX.

b) Advertising & audience vendors

The “Overview – Noteworthy Hosts and Issues” table highlighted a dense cluster of ad-tech and audience partners, including (illustrative):

Programmatic advertising & retargeting
- The Trade Desk (adsrvr.org endpoints).
- Google Ads / DoubleClick (googleads.g.doubleclick.net).
- Microsoft/Bing Ads and related endpoints.
- Index Exchange, Magnite, PubMatic, and other exchanges.
Identity & graph vendors
- Neustar / Verizon Media (agkn.com).
- Tapad cross-device ID endpoints.
Direct-mail / retargeting
- PebblePost (pbbl.co) providing post-card / direct-mail retargeting based on web visits.

Key Insight: These vendors appeared across high-intent flows, including itinerary browsing, information requests, and quote forms — meaning detailed travel preferences were being shared with advertising partners

c) Analytics, session replay, and UX insights

Web analytics
- Google Analytics (including GA4-style payloads).
- Adobe Analytics, configured through Aurelia’s parent-brand tag manager.
Session replay & behavioral heatmaps
- A provider like Crazy Egg or similar monitoring page interactions, scroll, click patterns, and potentially form behavior.
Performance & error monitoring
- APM tools or error trackers (e.g., Sentry-style, Site24x7-style monitoring).

d) Personalization & testing

On-site personalization / decisioning
- A vendor similar to Salesforce Interaction Studio or other experience platforms.
- These endpoints received behavioral data about which itineraries and pages were viewed, enabling fine-grained personalization.

e) Media and VR experiences

Video & media players (e.g., Vimeo-type hosts) for promotional films.
360° virtual tour platforms for hotel interiors and suites.

Observed patterns

The overview narrative concluded that Aurelia Regent operates a data-intensive, marketing-optimized environment, where:

Numerous third parties can observe high-intent travel browsing, including suite search, and quote form launches.
Advertising and analytics vendors appear before and after consent interactions, raising potential questions about when tracking begins and ends.

4.2 Data Detections – Noteworthy Transmissions

The Data Detections module, using both host intelligence and contextual tagging (hospitality / travel), surfaced a set of noteworthy transmissions of personal and potentially sensitive data.

Types of data observed

Examples included:

Identifiers and contact data
- Email address fields from “Request More Information,” “Request a Call,” and “Stay in Touch” forms.
- Phone number fields associated with call-back requests.
- Names (first and last) and country/region.
High-intent behavioral signals
- Itinerary codes and suite categories in URLs or payloads.
- Signals like “information requested,” “quote_started,” “quote_submitted.”
Location & preference indicators
- Destination region selection
- Time-frame preferences (e.g., “Summer 2026”).
- Travel party size and potential spend indicators (“Owner’s Suite”, “Penthouse”).

Example distilled table (in the report)

Detections – Noteworthy Transmissions

Company	Host	Role	Data	Issue
The Trade Desk	insight.adsrvr.org	Advertising	Hashed email from information request	May indicate use of hashed contact data to power advertising/retargeting; may warrant review under “sale/share” definitions.
PebblePost	px0.pbbl.co	Direct-mail Ads	Persistent person ID linked to lead forms	Suggests direct-mail retargeting based on site interactions; requires alignment with disclosures and opt-out configuration.
Neustar	aa.agkn.com	Identity/graph	Shared person and device identifiers	Identity graph endpoints receiving linked IDs may support cross-context profiling; may warrant targeted advertising review.

4.3 Key-Value Dump – Identifiers, Segments, and Profiles

The Key-Value Dump module (with host enrichment) added nuance around how users are tracked and segmented.

Signals uncovered

Advertising identifiers
- Cookies and parameters such as TDID, TDCPM, IDE, and partner IDs.
- Some values are long, encoded payloads carrying segment membership and partner mappings.
Audience & segment labels
- Keys and values such as:
  - segment=aurelia_ultra_luxury_traveler
  - bucket=high_value_suite
  - intent_score=9 (or similar numeric ranking)

Key Insight: These segment labels suggest profiled user intent and potential targeting categories. Depending on jurisdiction, this may raise questions about profiling and automated decision-making around high-value financial decisions.

Personalization identifiers
- Pseudonymous user IDs for on-site personalization:
  - anonId, _persistedUserId, site-specific “experience profile” IDs.
- Often observed across multiple sessions and pages, indicating persistent behavioral tracking.

Example KV table (in the report’s appendix or main section)

KEY–VALUE FINDINGS – NOTABLE ITEMS

Company	Host	Role	Key	Value (truncated)	Issue
The Trade Desk	insight.adsrvr.org	Advertising	TDID	42f1bc5d-2603-4e2a-84ec-ad58…	Persistent third-party identifier that may be used for cross-site audience targeting and frequency capping.
PebblePost	px0.pbbl.co	Direct-mail retargeting	_ppid	4e939270-19c4-4fa2-8767-6bd2…	Person/profile ID supporting offline direct-mail campaigns; linking site visits to physical addresses may warrant notice and opt-out review.
Neustar	aa.agkn.com	Identity graph / audience	_ppid, iid	4e93…, ab8f1ff4-39de-4610…	Shared IDs with PebblePost signal potential identity stitching across multiple partners; relevant to “sale/share” and targeted advertising analysis.
Personalization Vendor	profile.aureliaexp.com	On-site personalization / analytics	segment	ultra_lux_suite_intender	Indicates behavioral profiling and segment assignment; should be aligned with disclosed purposes and retention.

4.4 Consent & “Do Not Sell/Share” Behavior

Using the Overview plus filename-based opt-state classification, NT Analyzer compared:

“Consent given” / “Accept All” flows
vs.
“Reject All” / “Do Not Sell/Share” / “No consent” flows

Observations

Several core ad-tech and analytics vendors appeared in both states, with similar patterns of identifiers being transmitted.
Certain consent states appeared to suppress cosmetic UI tags but not deeper telemetry from embedded SDKs.
For some vendors, event volume and parameter richness decreased in “reject” state, but identifiers (e.g., advertising IDs) still flowed.

The report used cautious language:

“Based on observed traffic, some third-party vendors continued to receive identifiers and telemetry in scenarios labeled as ‘reject all’ or ‘do not sell/share.’ This may warrant further review of how the consent and opt-out choices are wired into the underlying tag and SDK configuration.”

4.5 Host Intelligence Layer

The host mapping module was particularly important in this case study:

It transformed opaque hosts like px0.pbbl.co, aa.agkn.com, insight.adsrvr.org into recognizable vendor names and roles.
It allowed NT Analyzer to generate tables that are meaningful for lawyers and executives rather than purely technical teams.

This host intelligence is what made tables like “Overview – Noteworthy Hosts and Issues” and “Detections – Noteworthy Transmissions” readable and actionable as client deliverables.

5. Risk Themes

Extensive advertising and identity infrastructure
- Multiple ad-tech and identity providers can observe high-intent browsing and certain lead-form behaviors.
- This ecosystem may implicate “targeted advertising,” “sale/share,” or cross-context behavioral advertising concepts under state laws.
Use of hashed contact data and persistent IDs
- Hashed email and persistent person IDs flow to certain third parties.
- While hashed, these may still be treated as personal data and can enable robust audience targeting or matching.

Profile- and segment-based decisioning
- On-site and off-site vendors use segments like “luxury suite intender,” “high-value traveler,” etc.
- Depending on jurisdiction, this may raise questions about profiling and automated decision-making, particularly around high-value financial decisions (e.g., pricing, offers, or eligibility).
Consent & choice implementation gaps
- Discrepancies between user-facing controls (“reject all,” “do not sell/share”) and technical behavior observed at the network layer.
- These may not reflect intentional design, but they warrant joint review by legal, product, and engineering stakeholders.

6. Recommended Remediation & Mitigation Steps

The final case study includes a prioritized mitigation roadmap, framed as recommendations:

Vendor inventory & governance
- Confirm the full list of advertising, identity, analytics, and UX vendors.
- Align contracts, DPAs, and data maps with the actual network flows observed.
Refine consent and opt-out wiring
- Ensure that “Reject All” and “Do Not Sell/Share” states truly suppress:
  - Advertising tags and pixels.
  - Cross-context identifiers and hashed contact uploads.
  - Session replay on sensitive flows (e.g., lead forms).
Minimize and segregate sensitive signals
- Avoid sending fine-grained preference, spend, or itinerary data to broad programmatic platforms unless necessary and disclosed.

Where needed, pseudonymize and aggregate values to reduce identifiability

Review identity and direct-mail retargeting programs
- Evaluate whether direct-mail and identity stitching vendors are properly disclosed, governed, and filtered based on user geography and preferences.
- Consider tiered retention policies for high-intent identifiers.
Ongoing NT Analyzer monitoring
- Incorporate NT Analyzer testing into periodic change-management and release cycles, especially when:
  - Adding new tags/SDKs.
  - Changing CMP configuration.
  - Launching targeted campaigns.

Conclusion

This case study demonstrates the power of network-level visibility for understanding what’s actually happening with website data flows. Aurelia Regent believed they were running a standard analytics stack, but NT Analyzer revealed an extensive advertising ecosystem with identity stitching, behavioral profiling, and consent implementation gaps that warrant immediate attention.

The luxury hospitality context makes this case study particularly compelling: high-net-worth travelers expect discretion, yet their detailed suite preferences and spending signals were being shared across dozens of third-party advertising and identity vendors. NT Analyzer provided the visibility needed to identify these issues and build a remediation roadmap.

Contact Us

For more information about NT Analyzer or to schedule a demo of the tool suite, please send us a request using the form.