Skip to content
Get started

Third-party check

Do4U checks which external servers a page contacts and which services are behind them. You enter the address of a page, and Do4U reads the HTML that the server delivers. It finds every external server in scripts, style sheets, preconnect and preload hints, images, frames, videos, forms, meta tags and in the code of the page, and matches it with a list of known services: fonts, analytics, tag managers, advertising, videos, maps, chats, consent tools, CDNs, payment and social media, each with the company behind it. For each one you see how it is included: loaded directly, connected in advance, in the page code or held back until consent. You also see whether a known consent tool is present. The check runs without AI and is free. It does not run JavaScript: scripts can load further services later.

Try it now Pricing

Who it is for

For website owners, agencies and data protection officers who want to know which third parties a page contacts before visitors agree, for example before they update the privacy policy or the cookie banner.

Typical uses

  • Find out which third-party services a page loads before consent
  • Check whether fonts are loaded from external servers
  • Compare the list with your privacy policy and your cookie banner
  • Check a page again after changing the consent tool

Example

Input

Address: https://www.example-shop.com/ HTML (excerpt): <script src="https://consent.cookiebot.com/uc.js" data-cbid="…"></script> <link rel="preconnect" href="https://fonts.gstatic.com"> <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Inter"> <script src="https://www.googletagmanager.com/gtag/js?id=G-XXXX"></script> <script>gtag('config', 'G-XXXX');</script> <script type="text/plain" data-cookieconsent="marketing" src="https://connect.facebook.net/en_US/fbevents.js"></script> <iframe src="https://www.youtube-nocookie.com/embed/abc"></iframe>

Result

Consent tools: consent.cookiebot.com – Cookiebot (Usercentrics): loaded directly Tag managers: www.googletagmanager.com – Google Tag Manager / Google tag (Google): loaded directly, also called in the page code (gtag) Advertising: connect.facebook.net – Meta Pixel / Facebook SDK (Meta): held back (type="text/plain") Fonts: fonts.googleapis.com – Google Fonts (Google): loaded directly Fonts: fonts.gstatic.com – Google Fonts (Google): connects in advance Video and audio: www.youtube-nocookie.com – YouTube (Google): loaded directly Consent tool found: Cookiebot. Each entry has a neutral note on what to check. Not legal advice.

A fixed example, shortened. Real results are AI-generated: please check them.

Price and limits

Price
free, without AI
Available with
Free, With package
Input limit
One page with up to 300,000 characters of HTML

Privacy

Processed on our own servers in the EU (Poland). Inputs and results are deleted after 7 days (Free) or 30 days (packages), or right after you see the result if you choose not to store them. Images are deleted right after processing.

In the API

Tool name: third_party_scan. Create a job with POST /api/v1/jobs and fetch the result with GET /api/v1/jobs/{id}. You find your API key in your account.

curl -X POST https://do4u.eu/api/v1/jobs \
  -H "Authorization: Bearer d4u_…" -H "Content-Type: application/json" \
  -d '{"tool": "third_party_scan", "url": "https://example.com/"}'

Full API documentation →

Questions and answers

Does the check see everything my page loads?

No. It reads the HTML that the server delivers and, where visible, the response headers. It does not run JavaScript, so services that a script loads later are not in the list, and neither are files that a CSS file loads. If your page builds its content with JavaScript, paste the HTML from your browser instead. For the full picture, also look at the network tab in the developer tools of your browser.

Does the result say whether my website may load these services?

No, this is not legal advice. The check shows what is loaded and how: directly by the HTML, connected in advance, in the page code or held back until consent. Whether a service needs consent and how your privacy policy has to name it, you check yourself or with someone who gives legal advice.

Why are cookies shown as "not visible"?

Do4U reads the page with its safe page reader, which does not pass on the response headers yet. That is why the check cannot say which cookies the server sets with its first response. You can see them in the developer tools of your browser (tab Application or Storage) after opening the page in a private window.

Is my text stored?

Only as long as needed: 7 days on Free, 30 days with a package – or not at all if you choose not to store it. Processing happens on our own servers in the EU (Poland).

Can I use the result right away?

Results are AI-generated. Please read them before you publish or send them.

Related tools

All tools →