This translation has not been editorially reviewed yet. The German version is authoritative. Deutsche Fassung →
Data protection
What third-party servers does my website contact just by loading?
Often more than the operator themselves knows: on the very first load, many websites' browsers already establish connections to third-party servers, and every one of these connections transmits the visitor's IP address. Our check logs every third-party server your page contacts before any consent, and categorises them: tracking, advertising, social networks, fonts, maps, or libraries.
Every connection transmits data — even without a cookie
The moment the browser contacts a third-party server, that server learns the visitor's IP address along with technical browser details. No cookie is needed for that — the connection itself is enough. The check recognises known tracking services by their server name: Google Analytics, Google Ads, Facebook, Hotjar, Microsoft Clarity, LinkedIn Insight, TikTok, and others. If one of these services is contacted before the visitor could consent, the check counts it as a violation and names every affected server in the report. In this case, the data transmission starts with the mere page visit.
Special case: Google Tag Manager
Google Tag Manager is a dispatcher that loads other scripts. If it loads before consent, that's acceptable with a correctly configured Consent Mode — it then stays silent until the visitor has chosen. Whether that setting is right can't be reliably determined from the outside, though. That's why the check deducts no points here, but sets a clear flag: needs manual review. Ask your agency specifically whether Consent Mode is set up, and what Tag Manager actually triggers before consent.
The complete third-party inventory in the report
Alongside the tracking services, the report lists every third-party server your page contacts on visit — sorted by category: fonts, maps, video, captcha, consent tool, libraries. External library servers like the jQuery CDN, cdnjs, or the Bootstrap CDN show up here too. There's no point deduction for these, since the legal classification is disputed — but the IP address flows to the operator here too, on page visit. The report's recommendation: host libraries locally on your own server. That avoids the transmission and also protects against outages at the third-party provider.
- Open your browser's developer tools with the F12 key, select the "Network" tab, and reload your homepage — every line is a connection.
- Ask your agency to control all tracking scripts through the consent tool, so no connection is made before consent.
- Ask specifically whether Google Tag Manager is configured with Consent Mode, if it loads before consent.
- Check after every new plugin or theme what third-party servers have been added.
- Have external libraries like jQuery or Bootstrap served from your own server.
FAQ
What does a tracking service learn when my page contacts it?
At the very least, the visitor's IP address, the time of the visit, and technical browser details. That happens automatically with every contact — no cookie is needed for it. That's why the measurement engine checks not just cookies but every connection established to a known tracking server before consent.
Is Google Tag Manager forbidden before consent?
With Consent Mode configured correctly, an early start is technically defensible — Tag Manager then holds off on tracking until the visitor has chosen. Because this setting can't be reliably detected from the outside, the check flags it for manual review instead of deducting points. The legal assessment remains a matter for your legal counsel.
Why does a connection count as a finding even without a cookie?
Because the data transmission begins with the connection, not just with the cookie. The contacted server receives the visitor's IP address the moment the browser reaches out to it. The check therefore documents every third-party server contact before consent — as a technical stock-take, not a legal opinion.
Are external libraries like jQuery from a CDN a violation?
The check deducts no points for this, since the legal classification is disputed. It does list the library servers in full, though, since the IP address flows there too on page visit. The recommendation is to host the files locally — that ends the transmission and makes the website independent of the third-party provider.