Stats as of 2026-07-23 03:23 UTC — last scan: 2026-07-23

31 scan batches run

14,387 of 87,696 available pages scanned (16.4% coverage) 13,333 of 14,387 scanned pages were reachable (92.7%) 6,244 reachable pages loaded at least one third-party script (46.8% of reachable) 8,886 known third-party service loads identified 22 unique known services across 14 categories

Third-Party JavaScript by Country

Country Scanned Available Reachable URLs with 3rd-Party JS Known Service Loads JS URLs /100 Reachable Known Loads /100 Reachable Last Scan
Austria 822 822 787 273 52 34.7 6.6 2026-07-23
Belgium 1,181 1,329 1,090 572 660 52.5 60.6 2026-07-20
Bulgaria 353 353 320 128 163 40.0 50.9 2026-07-23
Canada 369 4,469 354 186 310 52.5 87.6 2026-07-20
Croatia 257 257 254 140 194 55.1 76.4 2026-07-20
Czechia 866 866 796 491 832 61.7 104.5 2026-07-20
Denmark 1,492 1,536 1,461 810 2,074 55.4 142.0 2026-07-21
Estonia 401 401 382 132 111 34.6 29.1 2026-07-20
Finland 199 199 188 46 26 24.5 13.8 2026-07-21
France 271 10,009 239 137 48 57.3 20.1 2026-07-21
Germany 192 6,599 186 32 26 17.2 14.0 2026-07-21
Greece 520 1,752 490 227 298 46.3 60.8 2026-07-21
Hungary 392 392 296 126 190 42.6 64.2 2026-07-21
Iceland 145 145 143 77 46 53.8 32.2 2026-07-21
Ireland 536 536 497 268 755 53.9 151.9 2026-07-21
Italy 444 5,351 405 157 36 38.8 8.9 2026-07-22
Latvia 803 803 762 267 289 35.0 37.9 2026-07-21
Lithuania 122 122 112 57 113 50.9 100.9 2026-07-21
Luxembourg 573 573 445 311 137 69.9 30.8 2026-07-21
Malta 610 610 591 452 1,248 76.5 211.2 2026-07-22
Netherlands 945 945 897 371 288 41.4 32.1 2026-07-22
Norway 249 249 241 136 116 56.4 48.1 2026-07-22
Poland 493 14,951 464 222 313 47.8 67.5 2026-07-22
Portugal 140 3,508 123 39 34 31.7 27.6 2026-07-23
Cyprus 29 29 28 8 13 28.6 46.4 2026-07-22
Romania 145 807 50 40 32 80.0 64.0 2026-07-22
Slovakia 442 442 417 201 266 48.2 63.8 2026-07-22
Slovenia 214 214 200 50 79 25.0 39.5 2026-07-22
Sweden 1,184 1,702 1,117 288 137 25.8 12.3 2026-07-22

Hover or focus any non-zero country-table count to preview matching pages. Activate the number to keep the preview open and download a CSV for that country and metric from Download machine-readable third-party tools data (JSON).

Top Third-Party Services

# Service Loads
1 cdnjs (Cloudflare CDN) 1,923
2 jsDelivr CDN 1,664
3 Google Analytics (GA4) 1,199
4 jQuery 787
5 Google reCAPTCHA 566
6 unpkg CDN 551
7 Google Tag Manager 483
8 Google Hosted Libraries 481
9 CookieInformation 426
10 Cookiebot 358
11 Font Awesome 117
12 Bootstrap 96
13 OneTrust 67
14 Adobe Dynamic Tag Management / Launch 46
15 Facebook Pixel 46
16 Cloudflare Turnstile / Challenge 17
17 Google Analytics (Universal) 16
18 Sentry 15
19 Matomo Cloud 11
20 Zendesk 9

Top Services by Page Prevalence

# Service Reachable Pages Prevalence of Reachable Pages
1 Google Analytics (GA4) 1,175 105.2%
2 jsDelivr CDN 894 80.0%
3 cdnjs (Cloudflare CDN) 696 62.3%
4 Google reCAPTCHA 550 49.2%
5 jQuery 524 46.9%
6 Google Tag Manager 462 41.4%
7 CookieInformation 426 38.1%
8 unpkg CDN 421 37.7%
9 Google Hosted Libraries 415 37.2%
10 Cookiebot 353 31.6%
11 Font Awesome 111 9.9%
12 Bootstrap 96 8.6%
13 OneTrust 64 5.7%
14 Facebook Pixel 44 3.9%
15 Adobe Dynamic Tag Management / Launch 43 3.8%
16 Cloudflare Turnstile / Challenge 17 1.5%
17 Google Analytics (Universal) 16 1.4%
18 Sentry 15 1.3%
19 Matomo Cloud 11 1.0%
20 Zendesk 9 0.8%

Top Service Categories

# Category Loads
1 CDN 4,619
2 Analytics 1,322
3 JavaScript Library 1,268
4 Cookie Consent 851
5 Security 583
6 CAPTCHA 566
7 Tag Manager 529
8 Icon Library 117
9 UI Framework 96
10 Advertising 46
11 Error Tracking 15
12 Customer Support 9
13 Chat 9
14 Payments 4

Category Balance

Infrastructure-heavy categories (CDNs, core libraries, and UI assets):

# Infrastructure Category Loads
1 CDN 4,619
2 JavaScript Library 1,268
3 Icon Library 117
4 UI Framework 96

Policy-relevant categories (tracking, consent, support, and security tooling):

# Policy-Relevant Category Loads
1 Analytics 1,322
2 Cookie Consent 851
3 Security 583
4 CAPTCHA 566
5 Tag Manager 529
6 Advertising 46
7 Error Tracking 15
8 Customer Support 9
9 Chat 9
10 Payments 4

Unknown Third-Party Hosts (Review Queue)

# Host Loads Reachable Pages
1 cdn.ent.auvergnerhonealpes.fr 710 71
2 ajax.aspnetcdn.com 584 287
3 cuatro.sim-cdn.nl 390 11
4 customer.cludo.com 302 234
5 static.addtoany.com 289 289
6 cookie-notice.plzen.eu 274 146
7 cdn.public.lu 269 210
8 dreambroker.com 243 243
9 cdn.herning.dk 237 24
10 www.youtube.com 211 211
11 maps.googleapis.com 190 175
12 cdn.hjoerring.dk 188 17
13 siteimproveanalytics.com 185 185
14 cdn.nav.no 178 7
15 prod.widgets.burgerprofiel.vlaanderen.be 171 54

These hosts were seen as third-party script sources but did not match a known service signature. Review this queue regularly and promote stable, policy-relevant hosts into the signature list.

📥 Machine-readable results: Download machine-readable third-party tools data (JSON)

Overview

This scan identifies third-party JavaScript loaded by government websites, including analytics tags, tag managers, cookie-consent tools, CDNs, customer support widgets, and other externally hosted scripts.

The goal is to make the external dependencies used across European government sites easier to inspect. This helps answer questions like:

  • Which analytics or advertising vendors appear most often?
  • How common are third-party CDNs and consent managers?
  • Which countries lean more heavily on externally hosted web tooling?

The scanner looks at every <script src="..."> on a page, excludes same-origin scripts, and then tries to match known services such as Google Tag Manager, Google Analytics, Matomo Cloud, OneTrust, Cookiebot, Cloudflare, Microsoft Clarity, HubSpot, and more.

Why This Matters

Third-party JavaScript can affect:

  • Privacy: analytics, advertising, and tracking integrations may send data to external services.
  • Security: externally hosted libraries and widgets increase supply-chain risk.
  • Resilience: a page may depend on third-party infrastructure outside the control of the public authority.
  • Performance: extra scripts often increase page weight and network cost.

This page gives an EU-wide view of those dependencies.

Usage

Scan a single country

python3 -m src.cli.scan_third_party_js --country ICELAND --rate-limit 1.0

Scan all countries

python3 -m src.cli.scan_third_party_js --all --rate-limit 1.0

Scan all countries with a runtime cap

python3 -m src.cli.scan_third_party_js --all --max-runtime 110 --rate-limit 1.0

Command-line options

Option Default Description
--country CODE — Country code to scan (for example FRANCE or ICELAND)
--all — Scan all countries in the TOON directory
--toon-dir PATH data/toon-seeds/countries Directory with .toon seed files
--rate-limit N 1.0 Maximum HTTP requests per second
--max-runtime N 0 (no limit) Maximum runtime in minutes for graceful CI stops

GitHub Actions

The Scan Third-Party JavaScript workflow (.github/workflows/scan-third-party-js.yml) runs automatically every 6 hours and can also be triggered manually from the Actions tab.

Artifacts uploaded after each run:

Artifact Contents
3pjs-scan-<run_number> data/metadata.db, scan output log, annotated *_3pjs.toon files
validation-metadata data/metadata.db shared with the other scanners

Output

Annotated TOON file

Each page entry in the output *_3pjs.toon file gains a third_party_js field:

{
  "url": "https://example.gov/",
  "third_party_js": [
    {
      "src": "https://www.googletagmanager.com/gtm.js?id=GTM-XXXX",
      "host": "www.googletagmanager.com",
      "service_name": "Google Tag Manager",
      "version": "GTM-XXXX",
      "categories": ["Tag Manager"]
    }
  ]
}

If scanning failed for a URL, a third_party_js_error field is added instead.

Database table

Results are stored in the url_third_party_js_results table:

Column Type Description
url TEXT Page URL
country_code TEXT Country identifier
scan_id TEXT Unique scan run ID
is_reachable INTEGER 1 = page fetched successfully
scripts TEXT JSON array of third-party script records
error_message TEXT Error message if the page fetch failed
scanned_at TEXT ISO-8601 timestamp