Third-party scripts checker: who gets visitor data
The free third-party scripts checker shows which outside services (analytics and advertising code, fonts, maps, videos or chat) your homepage loads before any choice in the cookie banner, what they are for and in which country their provider is based. Each such service receives the visitor’s IP address; analytics and advertising code also receives further data about the visit.
What third parties on a website are
- A third party is any service on another domain that the page calls when it opens: traffic analytics, an advertising pixel, fonts, a map, a video, chat, a payment gateway or a library from a public CDN.
- The browser connects to it directly, so the provider receives the visitor’s IP address, the page address and browser details.
- Loaded is not the same as sent. Merely downloading a script or a font reveals the IP address to the provider. Analytics and advertising code also sends further data about the visit, such as a visitor identifier or a form submission. WebMeter tells these cases apart.
The main types of third-party services and what their provider receives:
| Type of service | Examples | What the provider receives | Lighter alternative |
|---|---|---|---|
| Traffic analytics | Google Analytics, Hotjar, Matomo Cloud | IP address, page address, browser details and a visitor identifier | start only after consent |
| Advertising and remarketing | Meta Pixel, Google Ads, Sklik | the same plus data about the visit, such as a form submission | start only after consent, remove the code when a campaign ends |
| Fonts | Google Fonts, Adobe Fonts | IP address and website address as soon as the page opens | fonts served from the website’s own server |
| Maps and videos | Google Maps, Mapy.cz, YouTube | IP address and website address as soon as the page opens | load only after a click on a preview |
| Chat | Smartsupp, tawk.to, LiveChat | IP address and page address; once a chat starts, also its content | load only after a click on the chat icon |
| Libraries and CDN | jsDelivr, cdnjs, unpkg | IP address and website address | files from the website’s own server, otherwise at least an integrity check (SRI); it stops a tampered file, not the IP address being passed on |
Why third parties matter for a small business
The consent rules for cookies and tracking are covered in the guide Cookies and GDPR on your website; here the question is where the data goes. The GDPR allows personal data to be transferred outside the EU and EEA only under set conditions. The simplest case is a transfer to a country for which the European Commission has adopted an adequacy decision, for example the United Kingdom, Switzerland, Canada or Japan. For the United States, the EU-US Data Privacy Framework has applied since 10 July 2023, but only to companies that have signed up to it. The EU General Court dismissed an action against this framework in September 2025; an appeal to the Court of Justice of the EU has not yet been decided.
Fonts from Google’s servers are a special case. In January 2022 the Munich Regional Court (LG München I) awarded a visitor one hundred euros in damages because a website passed his IP address to Google without consent, although the fonts could have been served from the site’s own server. This is a single German judgment; there is no comparable decision in Czechia.
Common third-party problems
- Analytics and advertising code that runs before any choice in the cookie banner.
- Fonts loaded from Google’s servers instead of the website’s own server.
- A YouTube video or a map that loads as soon as the page opens rather than after a click.
- Forgotten code from finished campaigns, and services added by a plugin or theme without the owner knowing.
- Libraries from public CDNs without an integrity check (SRI), so the browser can’t tell if the file on the other server has changed. The Content-Security-Policy header limits where a page may load scripts from; see the security headers check.
- Every additional third-party domain means a new connection to another server, and third-party scripts can slow down page loading. The website speed test shows how much.
Third-party tracker check: what is covered
WebMeter opens the homepage in a real browser, doesn’t scroll and never clicks the consent banner. It records every third-party domain the page sent a request to and, using its own list of more than a hundred known services, assigns a purpose (analytics, advertising, chat, video, maps, payments, fonts, libraries and CDN) and the provider’s country of registered office. What counts is the provider’s registered office (for multinational groups, the parent company’s), not where the servers are. Countries fall into four groups: EU and EEA, countries with an adequacy decision, the United States and other third countries. For fixed-version libraries from public CDNs it flags a missing integrity check.
Tracking that the website starts only after consent isn’t visible when the page opens. WebMeter therefore goes through the homepage code and up to eight JavaScript files from the website’s domain, looking for the addresses that analytics and advertising services load from, for example Google Tag Manager, Meta Pixel, Hotjar or Sklik (the advertising system of the Czech portal Seznam.cz). If no tracking loaded before consent, the report states that it is prepared in the code. The third-party overview has no score of its own; tracking before consent and fonts from Google are assessed in the Cookies and GDPR area.
It doesn’t see what the website loads after consent, on subpages or in the cart, or data the website sends from its own server. It doesn’t check whether a US company has signed up to the Data Privacy Framework, and it doesn’t assess processing agreements, the legal basis or privacy policies. Services outside its list are shown only with their domain, as unknown.
Check third-party scripts for free
Enter a domain and see which third-party services the homepage loads before consent, together with the other areas.
Not sure what to make of the result? We offer a no-obligation consultation — just write to kontakt@webmeter.eu.
Website design without unnecessary tracking scripts
We build the new website only with the services you really need: fonts from its own server, maps and videos loaded after a click, and tracking code only after consent. Before handover we run it through the same third-party check as here.
How website design works → Case study: from 73 to 97 points →
Frequently asked questions about third parties
May a website send visitor data to the United States?
The GDPR allows transfers to the US among other cases when the recipient has signed up to the EU-US Data Privacy Framework; for such companies a European Commission adequacy decision has applied since 10 July 2023. WebMeter doesn’t check whether a specific service has signed up. Consent to analytics and advertising is needed regardless of the country. The overall assessment is for a lawyer.
Why does WebMeter flag Google Fonts?
When a font is downloaded from Google’s servers, Google receives the visitor’s IP address, usually as soon as the page opens. WebMeter reports it only when the browser actually downloaded the font, and it doesn’t count fonts inside an embedded video or map.
How does WebMeter find tracking that starts only after consent?
It doesn’t run it. It searches the homepage code and the website’s JavaScript files for the addresses that analytics and advertising services load from, including scripts the banner keeps blocked. The result only says that the website has the service prepared; when and on which pages it runs can’t be told from the code.
What are third-party cookies?
Cookies stored not by the website being visited but by an outside service embedded in the page, typically an advertising network or an analytics tool. They are mainly used to follow a visitor across websites, and Safari and Firefox restrict them by default. Data leaves even without cookies, though: merely downloading a script, a font or a map reveals the visitor’s IP address to the provider.
Where can I see whether a US service has signed up to the Data Privacy Framework?
On the official Data Privacy Framework List at dataprivacyframework.gov, run by the US Department of Commerce. For each company it shows whether its participation is active. WebMeter doesn’t do this check; it only shows the country of the provider’s registered office.
Other areas checked
- What is SEO
- Security headers
- SPF, DKIM and DMARC check
- SSL certificate check
- Domain and DNS check
- Cookies and GDPR on your website
- Website speed
- SEO checker
- Website accessibility
- CMS and technology
- Website exposure check
- AI search engines
- Company and e-shop
- Search engines beyond Google
- NIS2 and your website
- Competitor comparison
- Overview of everything WebMeter checks
How the check treats your website is described on the page about the WebMeterBot robot; what is stored and for how long is in the data processing policy.