Third-party services on your website: what loads when

What a third-party service is

A third-party service is anything your page loads from a server that does not belong to you. Your page contains the address, and the visitor's browser fetches the file directly from that server: a font, a script, a video player, a map, a chat window. To do this, the browser has to connect to the other server. That server therefore receives the visitor's IP address and usually the address of your website as well. Some services also set or read cookies or similar data in the browser.

Typical services

The list is not complete. Tag managers are a special case: they are a single script, but they can load many other services that you do not see in the HTML. Consent tools are often third-party services themselves.

Why the moment of loading matters

Everything that is in the HTML of your page loads as soon as the page opens, before the visitor has clicked anything in a cookie banner. After a choice, only the services that the page held back are added. The diagram shows the order.

What the rules say

• EU: Article 5(3) of Directive 2002/58/EC (the Directive on privacy and electronic communications) allows storing information on a user's device, or accessing information already stored there, only if the user has given consent after clear and comprehensive information. Exceptions: the sole purpose is the transmission of a communication, or it is strictly necessary for a service the user has explicitly requested.
• Germany: § 25 TDDDG has the same structure. Storing and access are only allowed with consent based on clear and comprehensive information, and information and consent follow the GDPR. The two exceptions are in paragraph 2.
• Poland: Article 399 of the Electronic Communications Law of 12 July 2024 (Prawo komunikacji elektronicznej) requires that the user is first informed, among other things about the purpose, and then agrees. This does not apply where storage or access is necessary to transmit a message or to provide a service the user has requested. The act itself states that it implements Directive 2002/58/EC.
• GDPR: Recital 30 names IP addresses and cookie identifiers as examples of online identifiers that can be associated with natural persons. An online identifier is one of the examples in the definition of personal data in Article 4(1).

How to see what your site loads

1. 1Open your page in a private window, so that no earlier consent is stored. Do not click the cookie banner yet.
2. 2Open the developer tools of your browser and switch to the Network tab. Reload the page. Every request appears with the server it went to.
3. 3Sort or filter the list by domain. Every server outside your own domain is a third party. Note the service, the type of file and whether it appears before your choice in the banner.
4. 4Open the Application or Storage tab to see which cookies and storage entries exist before your choice.
5. 5Reject everything in the banner, reload and compare. Then accept everything and compare again. Services that appear before any choice or after a rejection need a closer look.
6. 6Repeat this for the main types of pages: the home page, a product or article page, the contact form and pages with videos or maps.

What a static scan can and cannot see

A static scan reads the HTML that your server delivers. It is fast and easy to repeat, so it is a good first look and a good check after every change. The browser test shows the rest.

Alternatives that load less

• Fonts: host the font files on your own server instead of loading them from a font service. Check the licence of the font first. Do not forget fonts that a theme, a plugin or a CSS file loads.
• Videos and maps: use click-to-load. The page first shows a preview image from your own server and a short note. The player or the map loads only when the visitor clicks. A privacy-enhanced video address still loads files from the video provider's servers.
• Chat: load the chat window only when the visitor opens it, or offer a contact form on your own server instead.
• Scripts and libraries from a CDN: put a copy on your own server. If you keep a CDN for good reasons, treat it like any other third-party service.
• Analytics: a tool that runs on your own server is not a third party in the technical sense. Which data it collects and whether you need consent, you still have to check.

Work with Do4U

The Third-party check shows which external servers a page contacts and which services are behind them. You enter the address of a page or paste its HTML. Do4U reads the HTML that the server delivers and finds external servers in scripts, style sheets, preconnect and preload hints, images, frames, videos, forms, meta tags and in the code of the page. It matches each one with a list of known services and the company behind it, and shows how it is included: loaded directly, connected in advance, in the page code or held back until consent. You also see whether a known consent tool is present. The check runs without AI and is free. It does not run JavaScript, so add the browser test for services that scripts load later.

Do4U finds hints, you check and decide. The result does not say whether a service is allowed.