Third parties before consent

What we check

We load the home page like a new visitor who has not clicked anything yet, so has not consented in the cookie notice either. In doing so we record:

• Requests to foreign servers, for example to Google, Facebook, YouTube, Hotjar or a booking tool,
• cookies set,
• entries in the browser storage (local storage).

We classify the third parties:

• Tracking and advertising services (e.g. Google Analytics, Meta Pixel, LinkedIn Insight Tag) that receive data before consent: serious defect, the check is set to 0. In the United States, where tracking needs no prior consent, a warning.
• Other third parties (e.g. Google Fonts, Google Maps, YouTube, font or script servers): warning, because the IP address is transmitted and this has to be stated in the privacy policy.
• Analytics or tracking cookies before consent: warning.

In the report you see the names of the services, the cookies and their lifetime. This is an automatic preliminary check, not legal advice.

Why it matters

Every time the page loads something from a foreign server, this server learns the IP address of the visitor, often also which page they are currently viewing. With tracking and advertising services there are also cookies that recognise the visitor across many websites.

• For visitors from the EU and the UK consent is required before tracking starts.
• In the United States visitors must be able to opt out of the sale or sharing of their data, and the privacy policy has to name the services.
• Data to other countries must be named in the privacy policy.

Tracking before any consent is one of the most common reasons for complaints and cease-and-desist letters, especially for websites that also address customers from Germany or Austria. Operators are often not aware at all of what their page loads: a theme includes Google Fonts, a plugin loads Facebook, an embedded map calls Google.

How to fix it

1. Remove what is unnecessary

Go through the list in the report. Is every service really needed? Old tracking codes from earlier campaigns or plugins that nobody uses any more are best removed altogether.

2. Local instead of external

• Fonts: download Google Fonts and include them from the website's own server. In WordPress the plugin "OMGF" helps.
• Scripts and libraries from foreign CDNs can also be included locally.

3. Load only after consent

Tracking, advertising, maps and videos should be loaded only once the visitor has consented. A consent tool such as Cookiebot, Usercentrics, Borlabs Cookie, Complianz or CookieYes does this. For maps and videos many tools show a placeholder with "Load content".

4. Privacy-friendly alternatives

• Analytics without cookies and without data sharing, e.g. with a self-hosted Matomo installation or a privacy-friendly European service.
• YouTube in "privacy-enhanced mode" (youtube-nocookie.com).

5. Complete the privacy policy

All remaining services belong in the privacy policy with purpose and recipient country.

How to check it yourself

Open the website in a private browser window and click nothing. Open the developer tools (F12), "Network" tab, and reload. All lines with foreign domains are third parties. Under "Application › Cookies" you see the cookies set.

Frequently asked questions

Is Google Fonts a problem?

If the fonts are loaded from Google servers, the IP address of every visitor goes to Google. This has to be stated in the privacy policy. It is simpler to host the fonts on the same server as the website. Then the transfer disappears altogether.

Is consent for tracking needed everywhere?

No. The EU and the UK require consent before tracking starts. US law allows tracking without prior consent but requires a way to opt out of the sale or sharing of data. Anyone who also has customers in the EU is safest with consent before tracking.

Is this legal advice?

No. We show which data is technically transmitted. Whether that is legally permissible in the specific case is for a professional to judge.