The most reliable way to identify third-party providers on a website is to systematically analyse your website’s network requests and check each external service against its data protection legal basis. For website operators, data protection officers and compliance teams, this review is not a one-off task but an ongoing process. The following article answers the key questions regarding third-party providers as a GDPR risk and shows how you can take a structured approach.
Which third-party providers are typically integrated into websites?
Most websites incorporate numerous external services that transmit data to third parties. The most common categories include web analytics tools, advertising services, social media plugins, font libraries, content delivery networks and payment service providers. Many of these services are activated by external JavaScript files or embedded content, and in doing so transmit user data to their providers.
In practice, website operators mainly encounter the following third-party providers:
- Analytics and tracking tools: Google Analytics, Matomo, etracker or similar services that measure user behaviour
- Advertising platforms: Google Ads, Meta Pixel or other retargeting solutions
- External fonts and media: Google Fonts, YouTube videos or mapping services such as Google Maps
- Consent management platforms: Usercentrics, Cookiebot or similar tools for managing consent
- Chat and support widgets: Live chat services or helpdesk solutions
- Social media integrations: Share buttons, feeds or login functions from Facebook, LinkedIn or X
What makes this particularly tricky is that many of these services are not integrated intentionally. Often, a single third-party provider loads additional external services. For example, integrating YouTube can result in Google Fonts, Google Static or AdSense for YouTube also being loaded, without the website operator having explicitly configured this.
Why do third-party providers pose a GDPR risk to website operators?
Third-party providers pose a GDPR risk because the mere integration of an external service triggers data processing. As soon as a user visits your website, their IP address is transmitted to the third-party provider’s server. This applies regardless of whether cookies are set or not, and gives rise to a data protection liability on the part of the website operator.
The legal risks arise from several factors:
- Lack of a legal basis: For many third-party providers, particularly in the categories of advertising and tracking, explicit consent from users is required. If this is not obtained, there is no legal basis under Article 6 of the GDPR.
- Data transfers to third countries: Services that transfer data to countries outside the EU are subject to additional requirements.
- If the company is not certified under the EU-US Data Privacy Framework or if other safeguards are lacking, the transfer may be unlawful.
- Lack of transparency in the privacy policy: All third-party providers used must be listed in the privacy policy. If services are omitted or described incompletely, this constitutes a separate breach.
- Services posing a particularly high risk: Certain services are classified as particularly problematic by data protection authorities and courts. Google Fonts, for example, was deemed to pose a risk under data protection law in Germany and Austria following court rulings in 2022 and 2023 when loaded via Google’s external servers.
For data protection officers and compliance teams, this means that the responsibility for ensuring third-party providers are integrated in a manner compliant with data protection regulations lies with the website operator, not with the service provider. A thorough review is therefore essential.
How can third-party providers on a website be identified and analysed?
Third-party providers can be identified by systematically recording and analysing a website’s network requests. Every external domain to which your browser establishes a connection when a page is loaded is a potential third-party provider. The analysis covers not only the home page but all relevant subpages, as different pages may load different services.
Manual analysis using browser developer tools
In the browser, the developer tools (F12 or right-click + ‘Inspect’) allow you to view all connections established whilst a page is loading under the ‘Network’ tab. This method is free, but time-consuming and prone to errors. It can serve as an initial guide for individual pages, but is hardly scalable for the systematic examination of multiple websites.
Automated analysis using specialised tools
Automated scanning tools analyse websites in a structured manner and identify embedded external services based on their domains. They distinguish whether a service is loaded before or after a user interacts with the consent banner. Important to note: Not every external domain corresponds to a known service. Sometimes images or static files are embedded from servers on a different domain belonging to the same company, which must be assessed differently under data protection law than the embedding of a genuine third-party provider.
When carrying out the analysis, you should consider the following aspects:
- Is the service loaded before or after consent is given?
- What is the legal basis for the service in question?
- Does data transfer take place outside the EU?
- Is the service mentioned in the privacy policy?
- Which cookies does the service set, and do these require consent?
To be able to carry out a thorough GDPR compliance check, a structured approach that takes both technical and legal aspects into account is recommended.
What measures are required to integrate third-party providers in a GDPR-compliant manner?
To integrate third-party providers in a GDPR-compliant manner, you must ensure a suitable legal basis for each service, manage services requiring consent via a legally valid consent management system, and transparently disclose all third-party providers in your privacy policy. The specific requirements depend on the service in question and its purpose of processing.
In practice, handling third-party providers in compliance with the regulations typically involves the following steps:
- Inventory: Compile a complete list of all integrated third-party providers, including services that are indirectly loaded via other services.
- Determine the legal basis: For each service, determine whether it may be operated on the basis of a legitimate interest, for the performance of a contract, or only with explicit consent. Advertising services generally always require consent.
- Set up consent management: Services requiring consent may only be loaded after the user has given their active consent. A technically functional consent banner is necessary for this, but is not sufficient on its own if it does not actually block the services.
- Update the privacy policy: All third-party providers used must be listed in the privacy policy with details of the purpose, legal basis and, where applicable, transfers to third countries. An automatically generated privacy policy based on the services actually detected can help to avoid gaps.
- Securing data transfers: For services that transfer data to third countries, check whether the provider is certified under the EU-US Data Privacy Framework or whether other suitable safeguards are in place.
Please note: This information does not replace individual legal advice. For binding assessments of your specific situation, we recommend consulting a qualified data protection officer or a law firm.
How often should third-party providers on a website be reviewed?
Third-party providers should be reviewed at least whenever a significant change is made to the website, as well as at regular intervals of two to four times a year. As websites are dynamic and the integrated services can change at any time due to updates, new plugins or changes made by service providers, a one-off review is not sufficient.
The following events should trigger an immediate re-assessment:
- Launch of a new website or a new section
- Installation or updating of plugins, themes or CMS components
- Integration of new marketing or analytics tools
- Changes to the privacy policy or the consent banner
- New case law or guidelines from data protection authorities regarding specific services
- A change of hosting provider or technical infrastructure
For data protection officers managing multiple websites, continuous monitoring is particularly important. Manual checks at short intervals are hardly practicable when dealing with a large number of websites, which is why automated monitoring solutions that trigger notifications automatically when changes occur are advisable.
Which tools help to monitor third-party providers on an ongoing basis?
Specialised compliance tools are suitable for the ongoing monitoring of third-party providers; these automatically scan websites, identify external services and continuously monitor changes. In addition, browser extensions can be used for quick individual checks, and consent management platforms for the technical management of consent.
When selecting a suitable tool, you should look out for the following features:
- Automatic detection of external services based on network requests and a comprehensive service database
- Checking consent behaviour: Are services loaded correctly only after consent has been given?
- Monitoring of multiple websites with automatic notifications in the event of changes
- Clear recommendations for action in the report, which are understandable even without in-depth technical knowledge
- Comparison with the privacy policy: Are all detected services mentioned in the privacy policy?
Important: No automated tool can replace a full legal review or guarantee that a website is fully GDPR-compliant at any given time. In most cases, automated scans provide a reliable basis, but do not necessarily cover all possible compliance aspects. The results should therefore always be assessed in conjunction with expert advice.
How decareto supports the monitoring of third-party providers
At decareto, we have developed a SaaS platform designed specifically for this task: the systematic, automated audit and ongoing monitoring of websites for third-party providers and GDPR vulnerabilities. Our platform helps data protection officers, law firms, agencies and compliance teams to maintain an overview without having to spend hours on manual checks.
Here’s what we do in practice:
- Fully automated GDPR website scans in minutes rather than hours, including subpages and password-protected areas
- Detection of over 4,000 third-party providers using a continuously updated database, with clear assignment of legal basis and consent requirements
- Consent behaviour testing: We detect common consent management tools and simulate user interaction to check which services are loaded before and after consent is given
- Continuous monitoring with automatic notifications in the event of changes to monitored websites
- Dynamic privacy policy generator for tailor-made privacy policies in 24 languages, based on the services actually detected
Structured reports with specific recommendations for action, which can be shared directly with clients or delivered under your own logo
If you wish to carry out a structured audit of your website or your clients’ websites for third-party providers and GDPR risks, you can try decareto for free. Get started for free now and see within minutes which external services are active on your website and where action is required.
