Stats as of 2026-11-09 21:18 UTC — last scan: 2026-11-09

501 scan batches run

87,690 of 87,696 available pages scanned (100.0% coverage) 81,824 of 87,690 scanned pages were reachable (93.3%) 38,938 reachable pages loaded at least one third-party script (47.6% of reachable) 46,532 known third-party service loads identified 26 unique known services across 17 categories

Third-Party JavaScript by Country

Country Scanned Available Reachable URLs with 3rd-Party JS Known Service Loads JS URLs /100 Reachable Known Loads /100 Reachable Last Scan
Austria 822 822 788 284 53 36.0 6.7 2026-10-29
Belgium 1,329 1,329 1,241 664 732 53.5 59.0 2026-10-31
Bulgaria 353 353 305 131 159 43.0 52.1 2026-10-26
Canada 4,469 4,469 4,281 2,501 3,416 58.4 79.8 2026-11-05
Croatia 257 257 254 139 192 54.7 75.6 2026-10-26
Czechia 866 866 804 479 736 59.6 91.5 2026-10-29
Denmark 1,536 1,536 1,507 824 2,049 54.7 136.0 2026-11-03
Estonia 401 401 385 140 117 36.4 30.4 2026-10-26
Finland 199 199 189 47 26 24.9 13.8 2026-10-26
France 10,009 10,009 9,292 4,251 2,349 45.7 25.3 2026-11-07
Germany 6,599 6,599 6,484 1,735 334 26.8 5.2 2026-11-08
Greece 1,752 1,752 1,647 819 1,110 49.7 67.4 2026-11-05
Hungary 392 392 307 133 195 43.3 63.5 2026-10-27
Iceland 145 145 143 81 43 56.6 30.1 2026-10-27
Ireland 536 536 499 272 687 54.5 137.7 2026-10-29
Italy 5,351 5,351 4,879 1,693 1,605 34.7 32.9 2026-11-08
Latvia 803 803 766 264 261 34.5 34.1 2026-10-29
Lithuania 122 122 114 57 103 50.0 90.4 2026-10-27
Luxembourg 573 573 538 405 351 75.3 65.2 2026-10-29
Malta 610 610 595 467 1,262 78.5 212.1 2026-10-28
Netherlands 945 945 915 374 271 40.9 29.6 2026-10-29
Norway 249 249 243 137 108 56.4 44.4 2026-10-27
Poland 14,951 14,951 13,715 7,179 9,854 52.3 71.8 2026-11-08
Portugal 3,508 3,508 3,220 1,335 2,148 41.5 66.7 2026-11-08
Cyprus 29 29 29 13 15 44.8 51.7 2026-10-28
Romania 807 807 352 256 262 72.7 74.4 2026-10-30
Slovakia 442 442 418 221 260 52.9 62.2 2026-10-28
Slovenia 214 214 207 56 74 27.1 35.7 2026-10-25
Spain 6,091 6,091 5,323 2,711 2,541 50.9 47.7 2026-11-08
Sweden 1,702 1,702 1,631 552 306 33.8 18.8 2026-10-30
Switzerland 2,123 2,123 2,078 417 435 20.1 20.9 2026-10-31
United Kingdom 19,511 19,511 18,681 10,301 14,478 55.1 77.5 2026-11-09

Hover or focus any non-zero country-table count to preview matching pages. Activate the number to keep the preview open and download a CSV for that country and metric from Download machine-readable third-party tools data (JSON).

Top Third-Party Services

# Service Loads
1 Google Analytics (GA4) 8,723
2 cdnjs (Cloudflare CDN) 7,714
3 jsDelivr CDN 6,304
4 Google reCAPTCHA 4,832
5 Google Tag Manager 4,105
6 Google Hosted Libraries 3,185
7 unpkg CDN 2,863
8 jQuery 2,747
9 Font Awesome 1,874
10 Bootstrap 915
11 Cookiebot 813
12 Adobe Dynamic Tag Management / Launch 526
13 Facebook Pixel 445
14 CookieInformation 395
15 OneTrust 323
16 Cloudflare Turnstile / Challenge 240
17 Sentry 222
18 Google Analytics (Universal) 86
19 Usercentrics 62
20 Matomo Cloud 49

Top Services by Page Prevalence

# Service Reachable Pages Prevalence of Reachable Pages
1 Google Analytics (GA4) 8,489 45.4%
2 Google reCAPTCHA 4,553 24.4%
3 jsDelivr CDN 4,273 22.9%
4 cdnjs (Cloudflare CDN) 3,931 21.0%
5 Google Tag Manager 3,915 21.0%
6 Google Hosted Libraries 2,866 15.3%
7 unpkg CDN 2,212 11.8%
8 jQuery 2,179 11.7%
9 Font Awesome 1,493 8.0%
10 Bootstrap 908 4.9%
11 Cookiebot 794 4.3%
12 Adobe Dynamic Tag Management / Launch 523 2.8%
13 Facebook Pixel 430 2.3%
14 CookieInformation 395 2.1%
15 Cloudflare Turnstile / Challenge 240 1.3%
16 OneTrust 225 1.2%
17 Sentry 207 1.1%
18 Google Analytics (Universal) 85 0.5%
19 Usercentrics 62 0.3%
20 Matomo Cloud 49 0.3%

Top Service Categories

# Category Loads
1 CDN 20,066
2 Analytics 9,853
3 JavaScript Library 5,932
4 Security 5,072
5 CAPTCHA 4,832
6 Tag Manager 4,631
7 Icon Library 1,874
8 Cookie Consent 1,593
9 UI Framework 915
10 Advertising 445
11 Error Tracking 222
12 Payments 45
13 Customer Support 29
14 Chat 29
15 CRM 11

Category Balance

Infrastructure-heavy categories (CDNs, core libraries, and UI assets):

# Infrastructure Category Loads
1 CDN 20,066
2 JavaScript Library 5,932
3 Icon Library 1,874
4 UI Framework 915

Policy-relevant categories (tracking, consent, support, and security tooling):

# Policy-Relevant Category Loads
1 Analytics 9,853
2 Security 5,072
3 CAPTCHA 4,832
4 Tag Manager 4,631
5 Cookie Consent 1,593
6 Advertising 445
7 Error Tracking 222
8 Payments 45
9 Customer Support 29
10 Chat 29
11 CRM 11
12 Marketing 11
13 Heatmaps 6

Unknown Third-Party Hosts (Review Queue)

# Host Loads Reachable Pages
1 cdn.ent.auvergnerhonealpes.fr 15,110 1,647
2 cdn.ecollege.haute-garonne.fr 2,435 270
3 translate.google.com 2,303 2,300
4 www.cqc.org.uk 1,799 1,779
5 maps.googleapis.com 1,702 1,684
6 content.powerapps.com 1,546 128
7 static.parastorage.com 1,499 140
8 www.styleguide.sachsen.de 1,279 320
9 cc.cdn.civiccomputing.com 960 957
10 ajax.aspnetcdn.com 898 443
11 static.addtoany.com 865 849
12 cdn-cookieyes.com 794 790
13 d2m1owqtx0c1qg.cloudfront.net 788 409
14 dksxg5o1pn16c.cloudfront.net 782 57
15 cdn.xl.pt 777 16

These hosts were seen as third-party script sources but did not match a known service signature. Review this queue regularly and promote stable, policy-relevant hosts into the signature list.

📥 Machine-readable results: Download machine-readable third-party tools data (JSON)

Overview

This scan identifies third-party JavaScript loaded by government websites, including analytics tags, tag managers, cookie-consent tools, CDNs, customer support widgets, and other externally hosted scripts.

The goal is to make the external dependencies used across European government sites easier to inspect. This helps answer questions like:

  • Which analytics or advertising vendors appear most often?
  • How common are third-party CDNs and consent managers?
  • Which countries lean more heavily on externally hosted web tooling?

The scanner looks at every <script src="..."> on a page, excludes same-origin scripts, and then tries to match known services such as Google Tag Manager, Google Analytics, Matomo Cloud, OneTrust, Cookiebot, Cloudflare, Microsoft Clarity, HubSpot, and more.

Why This Matters

Third-party JavaScript can affect:

  • Privacy: analytics, advertising, and tracking integrations may send data to external services.
  • Security: externally hosted libraries and widgets increase supply-chain risk.
  • Resilience: a page may depend on third-party infrastructure outside the control of the public authority.
  • Performance: extra scripts often increase page weight and network cost.

This page gives an EU-wide view of those dependencies.

Usage

Scan a single country

python3 -m src.cli.scan_third_party_js --country ICELAND --rate-limit 1.0

Scan all countries

python3 -m src.cli.scan_third_party_js --all --rate-limit 1.0

Scan all countries with a runtime cap

python3 -m src.cli.scan_third_party_js --all --max-runtime 110 --rate-limit 1.0

Command-line options

Option Default Description
--country CODE — Country code to scan (for example FRANCE or ICELAND)
--all — Scan all countries in the TOON directory
--toon-dir PATH data/toon-seeds/countries Directory with .toon seed files
--rate-limit N 1.0 Maximum HTTP requests per second
--max-runtime N 0 (no limit) Maximum runtime in minutes for graceful CI stops

GitHub Actions

The Scan Third-Party JavaScript workflow (.github/workflows/scan-third-party-js.yml) runs automatically every 6 hours and can also be triggered manually from the Actions tab.

Artifacts uploaded after each run:

Artifact Contents
3pjs-scan-<run_number> data/metadata.db, scan output log, annotated *_3pjs.toon files
validation-metadata data/metadata.db shared with the other scanners

Output

Annotated TOON file

Each page entry in the output *_3pjs.toon file gains a third_party_js field:

{
  "url": "https://example.gov/",
  "third_party_js": [
    {
      "src": "https://www.googletagmanager.com/gtm.js?id=GTM-XXXX",
      "host": "www.googletagmanager.com",
      "service_name": "Google Tag Manager",
      "version": "GTM-XXXX",
      "categories": ["Tag Manager"]
    }
  ]
}

If scanning failed for a URL, a third_party_js_error field is added instead.

Database table

Results are stored in the url_third_party_js_results table:

Column Type Description
url TEXT Page URL
country_code TEXT Country identifier
scan_id TEXT Unique scan run ID
is_reachable INTEGER 1 = page fetched successfully
scripts TEXT JSON array of third-party script records
error_message TEXT Error message if the page fetch failed
scanned_at TEXT ISO-8601 timestamp