A page can look completely static while quietly contacting five or ten outside companies. A font file comes from Google. A YouTube thumbnail comes from YouTube. A map, analytics script, chat widget or spam filter starts another connection. Each request can disclose technical data before the visitor has clicked anything.
The practical problem is not that every external request is automatically unlawful. It is that many website owners do not know which requests exist, when they fire or why they are necessary. A privacy notice cannot accurately describe a system nobody has mapped.
This article is a technical guide, not a legal opinion. It shows what developers can observe and change. The legal basis, necessity and wording still need case-specific review.
Start with the network, not the plugin list
Bottom line: record what the browser actually contacts on a clean first visit.
A WordPress plugin list or tag-manager workspace is only an inventory of known configuration. It misses resources added by themes, page builders, injected scripts, consent tools and third-party embeds. It also says nothing about timing.
Open the page in a fresh browser context, enable Preserve log in Developer Tools and reload it with the Network panel recording. Do this before accepting or rejecting anything. Group requests by domain and inspect initiators. The initiator often reveals which script, stylesheet or frame created the request.
Repeat the capture after each privacy choice. A useful evidence set contains at least:
| Test state | What it reveals |
|---|---|
| Fresh visit, no choice | Default behaviour before consent |
| Reject all | Whether optional services remain blocked |
| Accept selected categories | Whether category controls work |
| Accept all | Full third-party inventory |
| Withdraw consent | Whether future requests stop |
Save the HAR file, screenshots, test URL, timestamp and browser version. A claim such as “analytics is blocked” is much easier to defend when it points to a reproducible test.
Google Fonts can create an avoidable connection
Bottom line: if a font is important to the design, serving it from your own domain is usually the cleaner engineering choice.
A stylesheet from fonts.googleapis.com can instruct the browser to fetch files from fonts.gstatic.com. The visitor therefore connects to infrastructure outside the website operator’s direct stack. Replacing the import with locally hosted, properly licensed font files removes that runtime dependency.
Local hosting also makes the asset part of your deployment, caching and performance process. Subset the font, keep only the weights the design uses and set sensible fallback fonts. Then verify that no old import survives in a theme or page-builder block.
Do not claim that local fonts make the entire site compliant. They remove one data flow. The rest of the page still needs inspection.
Analytics must match the visitor’s choice
Bottom line: a banner is irrelevant if the analytics request has already fired.
Analytics can enter a site directly, through a tag manager, through a framework integration or through a marketing plugin. Blocking only one visible script may leave another path active. Test for both network requests and client-side storage before a choice is made.
Under Germany’s Section 25 TDDDG, storing information on or accessing information from a user’s terminal equipment generally requires consent unless the operation is strictly necessary for the service requested by the user. GDPR questions then remain for any processing of personal data. The distinction matters: consent for device access and a GDPR legal basis are related, but they are not the same test.
Engineering cannot decide the legal basis alone. It can ensure that the implementation accurately follows the decision: no optional tag before the required signal, no duplicate loader and no resurrection after rejection.
Embeds are pages inside your page
Bottom line: do not load an interactive third-party embed until the visitor asks for it when a preview can do the job.
A YouTube video, Google Map, scheduling widget or social post commonly arrives as an iframe. Loading the iframe gives the provider a chance to receive request metadata and run its own code. Privacy-enhanced modes can reduce some behaviour, but they do not turn an external iframe into a local asset.
A robust pattern is a two-step embed:
- Render a locally hosted preview image and a short explanation.
- Load the iframe only after an explicit click or the relevant consent choice.
- Provide a normal external link for visitors who do not want to load the embed.
The placeholder must not fetch its thumbnail from the same third party. Otherwise the preview defeats its own purpose.
Common sources that teams overlook
Bottom line: the quiet dependencies are often more important than the obvious marketing tags.
Check the following during a first-load capture:
- CDN-hosted JavaScript and CSS
- icon libraries and remote fonts
- video, map and podcast players
- CAPTCHA and anti-spam services
- chat, booking and support widgets
- payment or review badges
- A/B testing, heatmap and session-replay tools
- error tracking and application monitoring
- remote images, avatars and social previews
Some are essential to a requested transaction. Others are replaceable or can wait for interaction. That classification requires both a product owner and privacy counsel. The developer’s job is to expose the real flow and implement the agreed control.
Remove, localise, delay or document
Bottom line: every external request should have one explicit treatment.
Use four engineering options:
| Treatment | When it fits | Verification |
|---|---|---|
| Remove | The service provides no meaningful value | Domain disappears from all captures |
| Localise | Static asset can be served legally from your stack | Request goes only to your controlled host |
| Delay | Service is optional or interaction-driven | No request before the trigger |
| Document | Connection is retained after legal review | Notice, vendor record and runtime agree |
“Document” is not a technical fix for an unjustified request. It means the retained behaviour has an owner, a purpose and a reviewed basis.
A small regression test prevents the problem returning
Bottom line: treat unexpected third-party domains like any other production regression.
Create an allowlist of expected hosts for the no-consent state. A browser test can load key templates, collect hostnames and fail when a new external domain appears. The test will not determine legality, but it catches accidental additions during a theme update or marketing experiment.
Run it on the home page, contact page, article template and any page with maps or video. Retest after consent-tool changes and major dependency upgrades.
Frequently asked questions
Is every third-party request a GDPR violation?
No. The answer depends on the data, purpose, necessity, legal basis, recipient and transfer context. The request is evidence of a data flow, not a legal verdict.
Does Google Fonts require a cookie banner?
The stronger engineering move is to remove an unnecessary external font request by hosting licensed files locally. Whether a specific implementation requires consent is a legal assessment, not something a scanner can decide from the domain name alone.
Is YouTube’s privacy-enhanced mode enough?
It can change provider behaviour, but the browser still connects to an external service when the iframe loads. A click-to-load placeholder gives the visitor clearer control.
Can a crawler find all third parties?
No. Some services appear only after interaction, on specific templates, for certain locations or after a delayed script. Combine automated crawling with manual state-based testing.
Official references
- GDPR text
- Section 25 TDDDG
- DSK guidance for telemedia providers
- EDPB Data Protection by Design and by Default
Want evidence rather than a plugin inventory? Run the free website check to see which third-party requests your homepage makes before consent. Then read what developers can verify in a technical GDPR website audit and why a cookie banner is not the same as working consent controls.
