Audit of all third-party scripts documents data collection; undisclosed trackers flagged
Why it matters
GDPR Art. 13 requires controllers to disclose all recipients of personal data at the point of collection. ePrivacy Art. 5(3) requires prior consent for all non-essential tracking. An undisclosed third-party script — Facebook Pixel added via Google Tag Manager, a Hotjar session recorder, a LinkedIn Insight Tag — is a double violation: you are transferring personal data to a recipient not disclosed in the privacy policy, and doing so without consent. CCPA §1798.120 grants opt-out rights for data sharing with third parties for cross-context behavioral advertising; undisclosed pixels block users from exercising that right. The core AI-built app failure mode here is that tracking scripts accumulate across sessions and the consent infrastructure is never updated to match.
Severity rationale
Info because undisclosed scripts are a compliance gap rather than an immediate security threat, but each undisclosed script that loads before consent is a distinct ePrivacy and GDPR Art. 13 violation.
Remediation
Audit every layout file for third-party script tags, then verify each one is disclosed in the privacy policy and gated behind consent.
Script audit — check these files:
- app/layout.tsx (Next.js root layout)
- pages/_document.tsx (Next.js custom document)
- public/index.html (CRA / Vite)
- index.html (SvelteKit, Astro)
For each <Script> or <script> tag found:
1. Identify vendor and purpose (GA4, Facebook Pixel, Hotjar, Intercom, etc.)
2. Confirm it appears in the privacy policy under "Third-party services"
3. Confirm it is classified in the cookie register under the correct category
4. Confirm it is gated behind the matching consent category
(analytics scripts behind analytics consent; marketing behind marketing)
If using Google Tag Manager:
- GTM injects scripts not visible in your codebase
- Audit the GTM container: GTM → Admin → Container → Tags → list all active tags
- Or use browser DevTools Network tab to capture all third-party requests during a session
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Data Protection Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- gdpr · Art. 13 — Information to be provided where personal data are collected from the data subject
- gdpr · Art. 28 — Processor — disclosure of all third-party data recipients
- eprivacy · Art. 5(3) — Consent required for tracking scripts that access terminal equipment
- ccpa · §1798.120 — Consumer right to opt-out of sale or sharing with third parties
Taxons
History
- 2026-04-18·v1.0.0·Initial import from data-protection·automated