What data outflow on a website actually means
Data outflow sounds like a security incident, but first of all it is quiet normal operation. As soon as a page loads a font from a foreign CDN, embeds a map or runs an analytics script, the visitor's browser connects directly to the provider's server. It does not just fetch the desired file – the provider inevitably learns who requested which page and when. These connections add up quickly: on the 1,000 largest websites the median is 66 embedded third parties (Web Almanac 2024). Even away from the top the number is high, because a single advertising or consent script usually pulls in further endpoints.
The point is visibility. Most of these third parties appear on no list; they come from a theme, a plugin, a tag manager or are loaded only at runtime. That 45% of an average page's requests go to third parties (Web Almanac 2024) means: nearly every second connection leaves your own domain – and with it a piece of visitor data. As long as nobody records these flows, half of a site's traffic stays a black box. How much individual foreign scripts additionally burden security and speed is set out in the article on the risk of third-party scripts.
Why every third-party request transmits personal data
An HTTP request is never empty. Even the plain retrieval of a font file sends the visitor's IP address, the user agent (browser, version, operating system), the calling page as referer and, depending on context, any cookies set. That is no side matter: the European Court of Justice has already ruled that even dynamic IP addresses can be personal data (CJEU, Case C-582/14, Breyer). With that, every such request falls under the General Data Protection Regulation – regardless of whether the provider reuses the data or merely leaves it in a log.
The legal basis is decisive. Non-essential embeds that set or read identifiers require prior consent under German law (TDDDG, Section 25). Without it, the data outflow happens before consent – the classic case that surfaces in audits. Whether scripts fire despite missing or withdrawn consent is a monitoring topic of its own, explored in the article on consent tag drift.
Even without cookies, on every third-party call the browser sends: the IP address (a potentially personal datum according to the CJEU, Case C-582/14), the user agent with browser and system identifiers, the referer with the requested URL, the language and time-zone settings and technical headers. Together these form a recognisable fingerprint – and the destination server knows the time and page of the visit. Exactly these metadata flow out long before any tracking cookie enters the picture.
The third-country problem: why the USA is delicate since Schrems II
If the data flows to a host inside the EU, the familiar GDPR rules apply. Once it leaves the European Economic Area, things get more complicated. On 16 July 2020 the European Court of Justice invalidated the EU-US Privacy Shield agreement with its Schrems II ruling (CJEU, Case C-311/18). Since then every transfer of personal data to the USA requires a legal check. The data protection organisation noyb subsequently filed 101 model complaints against companies that continued to send data to the USA (noyb). The framework for this is Chapter V of the GDPR: a third-country transfer needs its own legal basis (GDPR, Art. 44 et seq.), such as standard contractual clauses (GDPR, Art. 46).
Since 10 July 2023 there is again an adequacy decision by the European Commission with the EU-US Data Privacy Framework (European Commission). It eases the situation but does not fully resolve it: it applies only to US companies that have actively certified under the framework and appear on the official list (European Commission). A destination host alone says nothing about that. Several European supervisory authorities had previously classified uncontrolled US transfers as unlawful – the Austrian data protection authority, for instance, judged the use of a widely used US web-analytics service in 2022 to breach the GDPR (Austrian data protection authority), and the French CNIL reached the same conclusion soon after (CNIL). So anyone measuring today must know not only that data flows to the USA, but to whom and on what basis.
The overview below shows how a destination host is classified by country and rating. The example hosts are generic; what matters is the pattern by which an audit files each flow.
| Category | Destination host (example) | Country | Classification |
|---|---|---|---|
| Web fonts (CDN) | fonts-cdn.example.net | USA | Third-country transfer |
| Tag / consent manager | tags.example-mkt.com | USA | Third-country transfer |
| Map / geo service | maps.example-geo.com | USA | Third-country transfer |
| Analytics (self-hosted) | static.example-de.de | Germany | First party |
| Delivery (EU CDN) | cdn.example-eu.de | EU | EU-internal |
The table makes the core of the task visible: not every third party is a problem, but every third-country transfer needs a deliberate decision. A prominent case is the embedded web font – how that turns into a transfer that can trigger a warning letter is described in the article on Google Fonts and the GDPR.
Legal consequences of unnoticed data outflow
Uncontrolled data outflow is no theoretical risk. Breaches of the GDPR transfer rules can be fined up to 20 million euros or 4% of worldwide annual turnover (GDPR, Art. 83). On top of that comes the reality of warning letters in Germany: the Regional Court of Munich I awarded a website visitor 100 euros in damages because a site loaded Google Fonts from a US server and thereby transmitted his IP address without consent (Regional Court Munich I, ref. 3 O 17493/20). After that ruling, waves of warning letters over exactly this inconspicuous data outflow followed across the country.
The security side adds to this. Third-party embeds are also part of a website's supply chain: a compromised external endpoint can harvest input or inject script. In the Verizon Data Breach Investigations Report, one in seven incidents recently – around 15% – involved a third party, an increase of 68% over the previous year (Verizon DBIR 2024). Anyone who does not know which foreign hosts their site contacts can neither narrow down nor monitor this attack surface.
A third party with a sound legal basis is perfectly fine. What is risky is the flow nobody knows about – the font from a US CDN that a theme brings along, the pixel a campaign tag pulls in, the map service on the contact page. Once you know these destinations, you can decide deliberately: self-host, replace, mitigate, or keep with a documented legal basis. Without that knowledge the decision falls silently against data protection, every single day.
Measuring data outflow: the network request audit
The first step is not a major project but a measurement. The compliance check and security scan renders the page in a real browser and logs every outbound request – exactly as a visitor's browser triggers it. Each destination host is then resolved and mapped to a country. The result is the view from the mockup above: your own page on the left, the data flows to its destination hosts on the right, each with a country code and a clear flag for whether it leaves the EU. That 45% of requests go to third parties (Web Almanac 2024) makes automatic evaluation necessary – this volume cannot be captured cleanly by hand.
What matters is that the measurement happens in the real rendering, not only in the served HTML. A large share of flows only arises at runtime: dynamically loaded scripts, redirects from one endpoint to the next, embeds from a tag manager. Only by seeing what the browser actually executes do you capture these destinations too. Four layers belong in a robust network request audit.
Log every outbound network request in real browser rendering – including dynamically loaded connections and those arising through redirects, which stay invisible in the raw source alone.
Determine the actual destination host for each request and distinguish it from your own domain. Only separating first from third party makes the actual data outflow measurable.
Map each destination host to a country and flag whether it lies inside the EU or triggers a third-country transfer. A host list thus becomes a map readable in data-protection terms.
A one-off snapshot ages with the next deploy. Only recurring measurement catches newly added destinations and reports when a flow quietly reaches a third country.
Two distinctions carry the whole audit. First: first-party requests stay on your own domain, third-party requests leave it – only the latter are a data outflow to a foreign controller. Second: a known, documented flow with a legal basis is different from a newly appeared one that nobody ordered. That is why the goal is not to ban every third party, but to know the list completely and to notice every change.
From audit to decision: which flow to check first
An audit typically finds more flows than expected – with a median of 66 third parties on large sites (Web Almanac 2024) that is no surprise. Working through the list does not mean rebuilding everything tonight. A short order of work by risk gets to the goal faster than blind activism.
- Third-country transfer without a legal basis first. A flow to the USA or another third country for which neither an adequacy decision nor standard contractual clauses exist (GDPR, Art. 44 et seq.) belongs at the top. That is the case authorities and warning letters notice first.
- Pre-consent flows next. If a destination fires before the visitor has consented although it would require consent (TDDDG, Section 25), the data outflow has already happened. Such flows weigh more than a destination that only loads after active agreement.
- Sensitive contexts after that. A third party near forms, login or payment is more delicate than the same one on a static subpage. Whether a contact form even delivers reliably belongs on the test bench here too.
- Document the rest. Whatever has a sound legal basis and loads after consent stays – but recorded in writing, so the decision stays traceable. This documentation is at the same time a building block of a data protection impact assessment for web tracking.
Measuring anew after every deploy
A one-off audit says how the site sends today. But the flows change with every release: a new plugin brings an advertising pixel, a marketing team adds a tag, a theme update swaps a CDN. That is why measurement belongs not in an annual audit but in ongoing monitoring – ideally after every deploy. With 45% third-party requests on average (Web Almanac 2024), a single new arrival is quickly overlooked.
If a new third-country transfer appears, it should not go unnoticed for weeks. A regression alert through the configured notification channels reports the new destination while the link to the last release is still fresh. The same deploy logic applies to neighbouring risks: a newly introduced vulnerable JavaScript library, a rising 5xx server error rate after a release, or extra transfer weight covered in the article on page weight and resource bloat. Data quality benefits too: knowing which foreign hosts are embedded makes it easier to separate real traffic from referrer spam and ghost traffic.
Getting started in practice needs no grand preparation: scan a single website, look at the list of destination hosts, classify the first third-country transfer. You will very likely find the list is longer than you thought – and the truly urgent cases can be counted on one hand. The interplay of audit, classification and alert is shown in the live demo; which feature is included in which plan is set out in the pricing overview. An invisible standing outflow thus becomes a deliberate, recurring decision.
This article draws on data and documents from: Web Almanac 2024 (HTTP Archive) – Third Parties chapters: 92% of sites with at least one third party, 45% of all requests to third parties, median of 66 third parties on the 1,000 largest websites; European Court of Justice – Schrems II ruling of 16 July 2020 (Case C-311/18, invalidity of the Privacy Shield) and the Breyer ruling on IP addresses as personal data (Case C-582/14); noyb – 101 model complaints on EU-US data transfers after Schrems II; European Commission – adequacy decision on the EU-US Data Privacy Framework of 10 July 2023; GDPR – Chapter V (Art. 44 and Art. 46, third-country transfer) and Art. 83 (fine framework of up to 20 million euros or 4% of annual turnover); TDDDG – Section 25 (consent requirement for non-essential embeds); Regional Court Munich I – ruling ref. 3 O 17493/20 (100 euros in damages over a Google Fonts transfer); Austrian data protection authority and CNIL – 2022 decisions on unlawful US transfers via a US analytics service; Verizon Data Breach Investigations Report 2024 – around 15% of incidents involving a third party, an increase of 68%.