What does it mean that my page loads something from third parties?

That a piece of it, such as the map, a font, a social media button or a visitor analytics tool, is not on your own website but, at the moment the page opens, comes from another company’s server (that is, the computer that sends the content). To fetch it, the visitor’s browser (the program they open pages with, such as Chrome or Safari) communicates with that company.

Since another company wrote the code, why am I responsible?

Because you decided to put it on your page. In 2019, in the Fashion ID case, the Court of Justice of the European Union ruled that a website that embeds Facebook’s “Like” button is jointly responsible with Facebook for collecting and transmitting its visitors’ data. In principle, it is not responsible for what Facebook does with the data afterwards.

Can someone really claim damages from me over something so small?

It has happened. In January 2022 a court in Munich awarded 100 euros to a visitor because a website sent his IP address to Google to load a font, without his consent. It is a German first-instance ruling and does not bind the Greek courts, but it shows how the consent rule can be read.

Is it a security risk too, not just a legal one?

Yes. Code (a script) that comes from a third party and loads directly into your page runs inside it with the same abilities as your own code. In June 2024, a popular free service that supplied code to websites changed owners and began sending some visitors, mostly on mobile, to scam pages. Over 100,000 websites were affected, without anything changing on the websites themselves.

Do I need to remove all third-party pieces?

Not necessarily. Many of them do useful work. But someone needs to know what your page loads and keep an eye on it over time, because whatever nobody looks at can change without you finding out. There is a way to keep what you need without exposing your visitors, and it takes a look at the specific website.

Third-party code on your website: who is liable

A customer opens your website’s home page. Before they have even seen the logo, their browser (the program they open pages with, such as Chrome or Safari) has already talked to several companies that are not yours. One sent it the font. One the map. One the social media button. One the visitor analytics tool. And each of them learned something about your customer.

The customer does not see this. Usually, neither do you.

In the article “Four things you do not know about your own website, and should” we explain how to see the list of what your page loads, and in “Your website is rotting on its own” what happens when such borrowed pieces stop working. Here we stick to two questions: who is responsible for what third parties learn about your visitors, and what happens when their code changes.

One page, many conversations

When a piece of your page comes from another company, the visitor’s browser has to communicate with that company’s server, that is, the computer that sends the content, to fetch it. In that exchange it sends at least the visitor’s IP address, that is, the address of their internet connection, which browser they use and which website they are on. Many such pieces also send exactly which page they opened.

This happens even if no cookie (the small file a website keeps on the visitor’s device) is stored. And under European law, an IP address is, as a rule, personal data.

Responsibility does not stay with whoever wrote the code

The reasonable objection is that Facebook or Google wrote the code, so the responsibility is theirs. The Court of Justice of the European Union ruled otherwise.

In the Fashion ID case (C-40/17, 29/07/2019), an online clothing shop had put Facebook’s “Like” button on its pages. The button sent visitors’ data to Facebook, even if they did not click it and even if they had no account. The Court ruled that the shop is jointly responsible with Facebook for collecting and transmitting that data. In principle, it is not responsible for what Facebook does with it afterwards. It is responsible for the fact that it left the shop’s page.

Put simply: since you decided to put such a piece on your page, you are responsible for whether your visitors were informed and, where needed, gave their consent. The fact that you never see the data does not let you off.

I am not a lawyer, and how this applies to each website needs to be looked at case by case. The rules on cookies and consent in Greece are in the article “GDPR and cookies in 2026”.

A font, one hundred euros

The most innocent case is the font. Many websites load their font from Google’s servers on every visit.

On 20/01/2022 a court in Munich (3 O 17493/20) awarded 100 euros to a visitor of a website. On every visit, the visitor’s IP address was sent to Google to load the font, without his consent. The court also ordered the website to stop sending it. The website argued that it had a legitimate interest, meaning it could send the data without consent because its operation needed it. The court rejected this, because the font could be used without sending anything to Google.

It is a German first-instance ruling and binds no one in Greece. The amount is small, and the mass letters demanding damages that followed in Germany were found abusive by other courts. But the reasoning is what matters: if the same result can be achieved without sending data to a third party, it is hard to argue that you had to send it.

Third-party code can do anything your own code can

The legal side is one half. The other is security.

Code (a script) that comes from a third party and loads directly into the page is not isolated from the rest of the page. It runs inside your page with the same abilities as your own code: it sees what the visitor sees, it can change what is displayed, it can send them elsewhere. And it runs whatever the third party sends today, not what existed on the day you added it.

In June 2024 it became clear what this means. A free service called polyfill.io, which a great many websites used to work properly in old browsers, had been bought months earlier by a new owner. Its code changed and began sending visitors, mostly on mobile, to scam pages. According to the security company Sansec, which made the attack public, over 100,000 websites were affected. Google began rejecting ads that led to pages with this code.

None of these websites had changed anything. Their owners had made no mistake that week. The mistake had usually been made years earlier, when someone put a piece on the page that was not theirs and nobody looked at it again.

What is up to you

Not every third-party piece needs to come off your website. But someone needs to know what is on your page and keep an eye on it over time. A piece that went in once and that nobody looked at again is a door someone else opens. If you cannot say which companies your page talks to today, there is a problem. There is a way to keep what you need without exposing your visitors, and usually without them losing anything they see. It is not a recipe that fits in a list: it takes work on the specific website, and it is learned in practice.

If you want a ready-made list of most of what your page loads, with what each item does written next to it, that is what MS-Consent does: it scans the page, shows you what it found, and actually blocks the pieces that need consent until the visitor agrees. And I say this with the caveat it deserves: it is ours.

Your page, your visitors

The visitor who opens your website trusts you, not the companies they do not know are inside the page. In the eyes of the law, and in theirs, what happens on your page is your responsibility.

If you do not know what your website loads from third parties, we check it for you. We give you in writing what we found and what we recommend. If you have MS-Consent on the Max plan, the page is rescanned every year, so you can see if something new has appeared. For ongoing care of your website there is maintenance and support. Send us your website’s address through the form.

The whole picture: this article covers one part of a larger subject. If you are after the whole of it, from beginning to end, it is in the guide to security and legal on your website.

What your page loads from third parties