Discuss your project

TOOLBOX · COMPLIANCE CHECK

Find Third-Party Services.

From which third-party servers does your home page load scripts, fonts, maps and videos? Enter an address and see where your visitors’ data flows, with a note and a source for every service.

The bot check protects the toolbox against automated abuse.

We load the page once without JavaScript and read the HTML and headers. We do not fetch the third-party services. We do not store results permanently.

WHAT IS CHECKED

Every Third-Party Server.
Every Data Flow.

Every script, font and video from a third-party server means: your visitors’ browser contacts another company. The check identifies over 40 known services, each by the host names from the provider’s documentation.

  • 01

    Fonts

    Google Fonts, Font Awesome and others, embedded as a stylesheet, @import or prepared connection.

  • 02

    Analytics, Advertising, Tag Managers

    Google Analytics, Tag Manager, Meta Pixel, LinkedIn Insight Tag, Microsoft Clarity, Hotjar and others, including in embedded loading code.

  • 03

    Maps, Videos, Social Networks

    Google Maps, OpenStreetMap, YouTube, Vimeo, Instagram and X as an iframe or script.

  • 04

    CDNs and Services

    Libraries from jsDelivr, cdnjs or unpkg, plus bot protection, payment, consent, chat and appointment booking.

  • 05

    Forms to Third-Party Servers

    Newsletter and form services to which input goes directly on submit.

  • 06

    Unknown Hosts

    The report also lists what belongs neither to your domain nor to a known service: a server of your own under another name or a third-party service.

WHEN IT LOADS

Right Away, Later
or Never.

Often what matters is not only which service is embedded, but when the browser loads it. The report distinguishes:

  • Loads on request: src, stylesheet or Link header. The browser fetches the content right away, before visitors could choose anything.
  • Connection prepared: preconnect already opens a connection to the provider; dns-prefetch only queries DNS.
  • Named in script code: the address is in an inline script, typical of tag managers and pixels. The script probably loads it.
  • Probably waits for consent: parked as type="text/plain" or in data-src, as consent tools do.
  • Only without JavaScript: in noscript, such as the fallback image of a pixel.

LEGAL FRAMEWORK

Sources Instead of
Verdicts.

For every kind of service, the report names the relevant provisions. It does not assess whether your integration is permitted; this is not legal advice. Our glossary explains the basics: GDPR, data processing and data residency.

  • Consent on the Device

    Section 165(3) TKG 2021: collecting data on the terminal equipment is only permitted with active consent, unless it is strictly necessary. According to EDPB Guidelines 2/2023, tracking pixels can fall under this too.

    Source: RIS: Section 165 TKG 2021

  • Legal Basis and Recipients

    Every processing needs a legal basis (Art. 6 GDPR); recipients belong in the privacy information (Art. 13(1)(e) GDPR).

    Source: GDPR (EUR-Lex)

  • Third Countries

    Art. 44 et seq. GDPR apply to transfers to third countries. For the USA, an adequacy decision has been in place since 10 July 2023, which only applies to companies on the Data Privacy Framework list.

    Source: Implementing Decision (EU) 2023/1795

  • Embedded Content

    According to the CJEU, a website operator that embeds a social network plugin can be jointly responsible for collecting and transferring the data (C-40/17, Fashion ID, still under Directive 95/46/EC).

    Source: CJEU C-40/17

  • Fonts

    Munich Regional Court I, judgment of 20 January 2022, 3 O 17493/20: passing the IP address to Google through Google Fonts without consent was not permitted in the individual case.

    Source: Bayern.Recht

  • Tracking Pixels

    In Guidelines 2/2023, the European Data Protection Board describes when pixels and URL tracking fall under Art. 5(3) of the ePrivacy Directive.

    Source: EDPB Guidelines 2/2023

The cookie check tests the cookies the server sets on the first request; the mixed content and SRI check tests whether third-party scripts are protected against manipulation.

QUESTIONS

Good to Know.

Does the check say whether my website complies with data protection law?

No. It shows from which third-party servers the home page loads something according to the delivered HTML, and names the legal framework with a source for every kind of service. Whether an integration is permitted depends on purpose, consent, contracts and your privacy statement. A technical check cannot judge that; the report is not legal advice.

Why is an embedded font an issue?

If the browser loads a font from a provider’s server, the provider learns the IP address of the visitors. In 2022, the Munich Regional Court I ruled in an individual case that passing the IP address to Google through Google Fonts without consent was not permitted because the font can also be used without a connection to Google, and awarded EUR 100 in damages (3 O 17493/20). Fonts can usually be served yourself.

My tag manager loads much more. Why is that missing?

The check does not run JavaScript. What a tag manager or another script only loads later in the browser is not in the HTML and is therefore missing. The check recognizes the tag manager itself if its address is in the HTML or in the embedded loading code. The developer tools of your browser show all requests of a page, in Chrome and Edge with F12 in the Network tab.

What does “probably waits for consent” mean?

Consent tools often park scripts with type="text/plain" or addresses in data-src until visitors agree. The browser then does not load them at first. The check recognizes this pattern but cannot check whether the tool is configured correctly. If a service is listed under “loads on request”, the browser fetches it right away, before anyone could choose anything.

Do I have to name every service in the privacy statement?

The GDPR requires you to name the recipients or categories of recipients of personal data (Art. 13(1)(e)). If the IP address goes to a third-party server when loading, that server is usually such a recipient. The report lists the third-party hosts and, where known, the provider with a link to its privacy information.

Does TOMORIS store my input or the result?

No, not permanently. Our server only fetches the page entered once; we do not fetch the third-party services, and the website checked sees our server, not your IP address. The result stays in memory for five minutes so that repeated requests do not put load on the website again, and it is deleted after six minutes at the latest. Details are in the privacy statement.

TOOLBOX

More
Tools.

YOUR NEXT STEP

You Have the Result.
What Comes Next?

We assess findings, prioritize by risk and put changes into practice on request: as a project with EXPERTS or as ongoing operations with GRID.

Discuss the Result