Third-party request map

A page is assembled from many servers

The address in the browser bar names one site, but the HTML that comes back is really a list of errands. Fetch this font from Google, this script from a tag manager, this video player from YouTube. The browser does as it’s told and opens a connection to each of those hosts. Any host that doesn’t belong to the site you’re visiting is a third party.

None of these connections is anonymous. Each one carries the visitor’s IP address, the browser and system in the User-Agent header, and normally a Referer header naming the site or the exact page being read. If the third party has stored a cookie in that browser before, on any site, the cookie goes along too. So a company present on many sites can recognize one person moving between them. Often the site owner never chose any of this, and a theme or a plugin added the request.

How the map is drawn

Our server downloads the page and reads its source. It collects the hosts named in scripts, stylesheets, images and srcset lists, media, iframes, preconnect and preload hints, form targets, CSS url() values and tracking pixels inside <noscript>. When the page loads Google Tag Manager, we fetch the container file as well (two containers at most) and search it for services it can inject.

Each host is compared with a list of about 120 known services, which gives a name, an owner, the country of the owner’s headquarters and a category. Hosts that match nothing are grouped by domain and shown as unidentified. An address that’s merely written inside an inline script is kept only when it belongs to a known service, because scripts mention plenty of addresses they never call.

Up to 40 hosts are then located. A DNS query returns an IP address, and the Team Cymru IP-to-ASN service returns the network that announces that address and the country where the block is registered. The table is sorted from the most intrusive category to the least: advertising, analytics, social media, marketing, chat, video, maps, forms, payment, fonts, bot protection, consent tools, libraries, hosting. The “Tracking” counter adds up the first four.

Three meanings of “where”

Where the IP block is registered

This is what the map shows. It’s an administrative fact recorded by the regional internet registries.

Where the machine that answers stands

Large networks announce the same address from data centers on every continent and route each visitor to the nearest one. A block registered in the United States may be answered from Frankfurt for a visitor in Germany, and the data may get copied somewhere else afterwards.

Where the company is based

Shown as “HQ” in the table. It decides which courts and authorities can demand data from the company, wherever its machines are.

Laws on international transfers mostly look at the third meaning and at the contract in place. Under Chapter V of the GDPR, personal data may leave the European Economic Area only toward a country covered by an adequacy decision, or with safeguards such as standard contractual clauses.

Shortening the list

• Remove what nobody uses. Pixels from finished campaigns and widgets from uninstalled plugins go on reporting for years.
• Serve static files yourself. Fonts, icon sets and script libraries can be copied to your own domain. With HTTP/2 that’s usually faster than a public CDN, since browsers no longer share cached files between sites.
• Load embeds on demand. Show an image in place of a video or a map and load the real thing on click. The click-to-load embed tool writes that code.
• Say less to those that remain. Referrer-Policy: strict-origin-when-cross-origin sends third parties your domain instead of the full page address.
• Keep the list from growing back. A Content-Security-Policy header works as an allowlist. A host that isn’t on it can’t be called, whatever a plugin adds.