US trackers embedded in the shipped code
Scan rule · RSC-PRV-002
- Privacy (GDPR)
- Severity: Low
Detects analytics and pixel scripts with third-country transfer (Google Analytics/Tag Manager, Meta Pixel, Hotjar, Segment) in the shipped markup. Whether they load only after consent is not checked by this rule — the browser check does that (RSC-PRV-005).
Why this matters
Analytics and tracking services based in the US typically set identifiers and transmit usage data as soon as they load. Under the GDPR this generally requires prior, active consent — not merely a notice banner running alongside.
This rule only establishes that such a service is embedded in the shipped code. Many well-maintained sites embed, for example, Google Tag Manager and correctly load it only after consent. Whether the transfer happens before consent is shown by the browser check: “Trackers fire before consent”.
A sensible order: load tracking only after active consent, make rejecting as easy as accepting — or switch to an analytics tool that works without personal data and is hosted in the EU. This is a technical assessment, not legal advice.
Scan tier
- External scan (anonymous)
How to fix it
Load trackers only after granular consent, or switch to an EU alternative.