A PDF can contain more than what you see on the page. Embedded JavaScript, hidden form fields, remote resource calls, and custom metadata can all be used to track when a document is opened, where it is opened from, and what the reader does with it. PDF Security scans for tracking mechanisms are becoming a standard step in business due diligence, particularly when receiving PDFs from unknown or untrusted sources. The question is not just whether tracking code exists, but whether you have the tools to detect it before opening a sensitive document.
Tracking code in PDFs falls into two categories: intentional and benign. Intentional tracking uses JavaScript to phone home when the document is opened, sending the opener's IP address, approximate location, and reading duration to a tracking server. Benign tracking includes features like read receipts embedded in PDF invoices or digital rights management that verifies a license before displaying content. Both types use similar technical mechanisms, and the detection methods described here work for both.
WukongPDF's PDF Privacy features include security inspection tools that scan documents for embedded scripts before processing. Running a quick check before opening a PDF from an unfamiliar sender adds a layer of protection against tracking that most PDF readers do not provide by default.
How PDF Tracking Code Works Technically
PDF files support JavaScript through the Acrobat JavaScript API, a subset of JavaScript that runs within the PDF reader's scripting engine. Document-level scripts execute automatically when the PDF is opened, when a page is viewed, when the document is printed, or when it is closed. A tracking script typically runs on the DocOpen event, collects information available through the JavaScript API such as the reader's IP address through an HTTP request, and sends that data to a remote server using the app.launchURL or Net.HTTP.request methods.
The data that PDF JavaScript can collect is limited compared to browser JavaScript. It cannot access files on the user's computer, read browser cookies, or interact with other open documents. It can, however, make network requests, which is the core capability that enables tracking. A PDF opened in Adobe Acrobat Reader with JavaScript enabled will execute the tracking script silently. A PDF opened in a browser-based viewer that does not support the Acrobat JavaScript API will not execute the script, and the tracking attempt fails silently.
Method 1: Check for JavaScript in Adobe Acrobat Pro
The most direct way to check for tracking code is to inspect the PDF's JavaScript contents. In Adobe Acrobat Pro, open the PDF, go to the Edit menu, select Preferences, then click the JavaScript category. Uncheck Enable Acrobat JavaScript to globally disable all JavaScript execution in the reader. This prevents any tracking script from running when you open the file. Before disabling JavaScript, you can inspect what scripts exist without executing them.
To inspect scripts, open the PDF in Acrobat Pro and go to Tools, then JavaScript, and select Document JavaScripts from the dropdown. The dialog lists every document-level script by name. Select a script name and click Edit to view its source code. Look for patterns that indicate tracking: URLs pointing to external domains, app.launchURL calls, Net.HTTP.request calls, or references to this.docOpened or this.docClosed events. If the script makes network requests and you did not expect the document to need network access, treat it as potential tracking code.
You can delete individual scripts from the Document JavaScripts dialog. Select the script name and click Delete. After removing all suspicious scripts, save the PDF under a new filename to preserve the original as evidence. The cleaned PDF retains all visible content and form functionality but no longer executes the removed scripts.
Method 2: Inspect PDF Internals With a Text Editor
For a deeper inspection that does not require Acrobat Pro, examine the PDF's raw internal structure. PDF files use a text-based object format that human-readable strings and keywords interleaved with binary data. Open the PDF in a text editor capable of handling large files, such as VS Code, Notepad++, or Sublime Text. Search for the string /JavaScript or /JS. These keywords mark the beginning of JavaScript code objects. The script source code follows the keyword, usually between parentheses or between stream and endstream markers.
Also search for /URI or /URL to find any hardcoded web addresses embedded in the PDF. A tracking script may include the URL of a tracking server. Search for /AA or /OpenAction, which are PDF dictionary keys that specify actions to perform when the document is opened. An /OpenAction entry pointing to a JavaScript object is the most common mechanism for triggering tracking code on document open.
This manual inspection approach requires some familiarity with PDF syntax but catches tracking code that automated tools might miss. It is the same technique that security researchers use to analyze suspicious PDF attachments in phishing investigations. If you find tracking structures and want to neutralize them without Acrobat Pro, you can delete the relevant objects from the raw PDF using a tool like qpdf with the --remove-restrictions flag, though this approach requires care to avoid corrupting the file structure.
Method 3: Automated PDF Security Scanners
Several free and commercial tools automate the detection of tracking and malicious code in PDFs. DID-SIEM and similar security analysis tools parse the PDF structure and flag objects containing JavaScript, external URLs, launch actions, and embedded files. Online PDF security checkers accept a file upload and return a report listing all potentially trackable elements. For routine checking of PDFs received from external sources, an automated scanner is faster and more thorough than manual inspection.
| Indicator | What It Means | How to Check |
|---|---|---|
| Document JavaScript | Scripts that execute when the PDF opens, closes, or prints | Acrobat: Edit, Preferences, JavaScript panel |
| External resource calls | PDF loads images, fonts, or data from remote URLs when opened | Check document properties for embedded URLs |
| Hidden form fields | Invisible fields that pre-fill with tracking IDs or tokens | Open Forms panel and look for hidden field flags |
| Metadata scripts | XMP metadata containing custom tracking identifiers | View document properties and raw XMP data |
What to Do If You Find Tracking Code
Finding tracking code in a PDF you received does not necessarily mean the sender is acting maliciously. PDF invoices commonly include read-receipt scripts that notify the sender when the invoice is opened. Marketing materials may include engagement tracking similar to email open tracking pixels. The question is whether the tracking is disclosed and appropriate for the document type. A read receipt in an invoice is expected. A hidden tracker in a contract sent during a negotiation is problematic.
If you need to share the document with others without the tracking code, strip the JavaScript as described in Method 1 and save a clean copy. If the tracking code is part of a DRM or license enforcement system, removing it may violate the terms of use for the document. For legally sensitive documents, consult with your organization's legal or security team before stripping any embedded code, as the tracking mechanisms may be part of a compliance or audit trail system that you are contractually obligated to preserve.
PDF tracking code is detectable with the right tools. Running a quick JavaScript inspection before opening PDFs from unfamiliar sources takes less than a minute and catches the majority of tracking mechanisms. Making this check part of your standard document-handling routine reduces the likelihood of unknowingly sharing your reading activity with external parties. For organizations handling sensitive documents, a policy of disabling JavaScript in the PDF reader by default and enabling it only for trusted documents provides a strong baseline defense with no ongoing inspection effort per document.
Disabling JavaScript Across All PDF Readers in an Organization
Individual inspection of each PDF for tracking code is practical for occasional use but does not scale to an organization receiving hundreds of external PDFs daily. A more systematic approach is to disable JavaScript execution at the reader level across all devices. In Adobe Acrobat Reader, the setting lives under Edit, Preferences, JavaScript, where unchecking Enable Acrobat JavaScript blocks all script execution. This setting can be deployed through Group Policy on Windows, through a configuration profile on Mac, and through managed preferences on enterprise deployments of Acrobat Reader.
Disabling JavaScript globally does have a functional impact. Some PDF forms use JavaScript for field validation, automatic calculations, and dynamic form behavior. These features stop working when JavaScript is disabled. For organizations that rely on interactive PDF forms, the approach should be to disable JavaScript by default and enable it only for forms from trusted internal sources, rather than accepting the security risk of JavaScript execution on every PDF from every external sender. PDF security inspection for tracking code is a modern document literacy skill. Taking one minute to check for JavaScript, external URLs, and hidden form fields before opening or sharing a PDF from an unfamiliar source prevents a subtle form of information leakage that most PDF users are not even aware exists. A security-conscious approach to PDF handling protects both individual privacy and organizational information security without requiring specialized software or advanced technical knowledge.