Advertising and tracking endpoints

Every third-party host named in the HTML the server delivered is matched against the same two filter lists most ad blockers are built on: EasyList, which names advertising endpoints, and EasyPrivacy, which names tracking, analytics and telemetry endpoints. Only whole-domain entries are used — a list rule covering one file on a shared CDN says nothing about the CDN itself, so it is ignored rather than counted. A host matches if it or any parent domain is named, so pagead2.googlesyndication.com matches a rule written for googlesyndication.com. The check reports the matching hosts; it does not judge whether you should have them.

This is the list of companies that receive your visitors' IP address, user agent and the page they were reading, on every page view, whether or not anyone consented. Two separate problems follow from it. The first is legal: under GDPR and the ePrivacy Directive, advertising and analytics endpoints are precisely the ones that require consent before they load, and a tag that fires on page load has already sent the data by the time a banner appears. The second is performance and supply chain: each of these hosts is a script with full access to the page, an extra DNS lookup and connection, and a third party whose outage or compromise becomes yours. The tracking guide explains what these endpoints collect and how.

A match is not an accusation. Plenty of sites run analytics deliberately and lawfully. The value of the list is that it makes the set explicit, which is the thing most teams have never actually seen written down.

One limit worth knowing: this reads the HTML your server sent, so it sees the tags that are in the page. A tag manager that injects further scripts after the page loads is counted once, as the tag manager — what it goes on to load is not in the HTML and is not counted here. On a site whose advertising is loaded entirely by script, expect this list to be shorter than what a browser's network panel shows.

Start by naming an owner for each host. Anything nobody claims should go — abandoned tags outlive the campaigns that added them by years.

For what stays, load it after consent rather than before. A tag manager that fires on page load defeats the consent banner in front of it:

<!-- not loaded until consent is recorded -->
<script>
  window.addEventListener("consent:analytics", function () {
    var s = document.createElement("script");
    s.src = "https://www.googletagmanager.com/gtag/js?id=G-XXXX";
    s.async = true;
    document.head.appendChild(s);
  });
</script>

Then stop the rest from being possible at all with a Content-Security-Policy that lists the hosts you meant to allow, so a tag added by someone else next quarter fails visibly instead of quietly shipping data:

Content-Security-Policy: script-src 'self' https://www.googletagmanager.com; connect-src 'self' https://region1.google-analytics.com

Server-side tagging (Cloudflare Zaraz, a self-hosted GTM container, Plausible or Matomo on your own domain) removes these hosts from the page entirely, which is the only fix that also makes the page faster. Whatever you keep, name it in your privacy policy: the list above is what a regulator would compile.