Extension Pro
Third-Party Script Detection
Inventory observed third-party scripts and tag managers, then compare their loading time with the detected consent state.
A vendor script can arrive through a template, a tag manager or another embedded service. When an audit finds a request before consent, the practical problem is locating that loading path. ConsentScope collects observed script information and groups it with vendor and timing context.
Use the inventory to investigate what loaded during the captured visit. A requested script is not proof that every function inside it executed, and a known vendor name does not reveal every use the site makes of that vendor. Unknown classifications need manual review.
The report complements cookie and network evidence. Start with the suspicious service, inspect its observed initiator where available, and ask the implementation owner to confirm which integration controls it.
Use the inventory to answer a specific question
Before changing a tag, write down the symptom: an analytics identifier appears on the product page before interaction, or a marketing endpoint is contacted after Reject. Then find the service in the script inventory. This keeps the investigation tied to a behavior instead of turning every third-party dependency into an undifferentiated warning.
Compare the failing page with a passing template. If the same container exists on both but only one page loads the vendor, inspect the route-specific configuration and page components. If the vendor appears twice, check for a second installation through the theme or a marketing plugin.
Keep loading, execution and collection distinct
| Evidence | What it supports | What it does not prove |
|---|---|---|
| Script URL observed | The browser observed that resource or script reference | All code inside it executed |
| Known vendor classification | A match to a recognized destination or pattern | The exact contractual purpose on this site |
| Request before detected consent | A timing observation to investigate | A complete legal assessment |
| Cookie written after the script | A useful sequence for investigation | A definitive causal link without further evidence |
Treat these distinctions as part of the report, not as fine print. They help the developer reproduce the issue and prevent a client from interpreting the inventory as a complete security review. Where possible, compare the script with a request and storage event from the same session.
Follow dependencies without guessing the owner
A chat widget may load a separate analytics library. A marketing integration may inject another vendor's resource. Record each destination and the available initiator context, then verify the dependency with the integration owner. The Initiator Trace view supplies a lead when browser metadata is available; it is not a guaranteed JavaScript stack trace.
For first-party proxy endpoints or server-side forwarding, browser observations stop at the visible request. You cannot infer all onward recipients from a URL on your own domain. Ask the server-side owner for the matching configuration and logs before claiming the data stayed within the organization.
Retest the action that introduced the script
If the vendor loaded only after opening a booking panel, repeat that interaction after the fix. Reloading the homepage alone will miss it. Include partial consent and withdrawal when the service can start during the current document lifetime.
Use the network request view for the associated transmissions and the snapshot workflow for a private engineering handoff. When the issue comes from a consent integration, the CMP guides provide the next configuration checks.
How it works
Start observation before reloading the page.
Review observed script destinations, vendor classifications and consent timing.
Exercise the relevant page interaction to check delayed or route-specific loading.
Confirm the loading path in the application or tag manager and repeat the test after a change.
Key benefits
A visit-specific inventory
See the scripts observed in the tested page session.
Vendor context
Group known destinations and investigate unrecognized ones.
A debugging starting point
Find candidates for duplicate or ungated integrations.
Who is it for
Developers
Audit script loading order and remove unauthorized tags before release.
Privacy engineers
Validate that consent signals actually block downstream scripts.
Marketers
Understand which tags are firing and whether they comply with consent choices.
Frequently asked questions
Does this show every script on every page?
Does loading GTM prove its tags executed?
Is a first-party script automatically safe?
Unlock Third-Party Script Detection with ConsentScope Pro
Extension Pro provides lifetime access to the paid browser features. Monitor and Agency are separate subscriptions for cloud monitoring. Compare the plans for your workflow.
View Extension Pro