A website can collect third-party tools surprisingly quietly. An analytics tag is added for a campaign, a chat widget for a launch, a video player for one landing page and a social advertising pixel to measure conversions. Months later, nobody is entirely sure which services still load, who owns their accounts or what would break if one disappeared.
That uncertainty matters because these tools do more than add features. They can affect loading speed, visitor privacy, consent choices, security and the company's reliance on outside suppliers. The sensible response is not to remove everything external. It is to know what is running and make each service earn its place.
Third-party does not mean unnecessary
A third-party script is code supplied by an external provider and run as part of your website. Common examples include analytics, advertising, live chat, embedded videos, maps, payment tools, review widgets, consent platforms and A/B testing services.
Many of these services are useful, and some support important customer journeys. The HTTP Archive's 2025 Web Almanac describes third parties as widespread building blocks for functions such as analytics, advertising, payments and content delivery. It also notes the trade-off: adding outside services can introduce performance, privacy and security concerns.
The difficulty is that a small visible feature may involve more than one external connection. A tag manager can load several marketing tools, while one provider may call additional services in the background. Looking only at the logos or widgets visible on the page will not reveal the complete picture.
The costs are wider than page speed
Performance and user experience
Every external resource has to be requested, downloaded and processed. Some scripts also wait for other services or perform work in the visitor's browser. The effect varies by device, connection, page and consent choice, which is one reason a clean laboratory test may not reproduce the experience of a real customer. Our article on PageSpeed scores and real-user performance explores that distinction in more detail.
A script may still justify its cost. A reliable payment service clearly has a different business value from a forgotten heatmap tool used for a campaign two years ago. Performance should therefore be considered alongside purpose, not used as an automatic reason to remove anything that comes from another domain.
Privacy and consent
In the UK, the rules are not limited to conventional cookies. The Information Commissioner's Office explains that scripts, tags, tracking pixels and web storage can fall within the Privacy and Electronic Communications Regulations when they store information on, or access information from, a user's device. Where personal data is involved, UK GDPR may also apply.
Not every technology requires consent in every circumstance. The purpose matters, and the current rules contain specific exceptions. A company still needs to understand what each tool does, what information it handles, which providers receive it and whether the website's privacy information and consent controls accurately reflect that use. A consent banner cannot govern a tool nobody knows is there.
Security and continuity
An external script is also a supplier dependency. Its behaviour, availability and future changes are not fully controlled by the website owner. If an account is compromised, a provider changes its service or an important tool is withdrawn, the effect may reach the website and its visitors.
This does not make every supplier unsafe. It means ownership matters: someone should know why the service is trusted, how access is protected, what support or contractual arrangement exists and what the fallback would be if it stopped working. The National Cyber Security Centre's supply chain guidance uses the same broader principle of understanding dependencies and maintaining oversight.
Build a register before making cuts
A useful review starts with evidence. Check the website as a visitor, but also inspect the content management system, tag manager, plugins, consent platform and any code or integrations that may add services conditionally. Different tools may appear only after consent, on certain pages, during checkout or for particular campaigns.
For each service, record:
- Purpose: what customer or business need it supports.
- Owner: the person responsible for the decision, account and renewal.
- Location: where it loads and whether it needs to run across the whole website.
- Data: what it collects, stores or shares, and with whom.
- Control: how consent, access, supplier settings and account recovery are managed.
- Value: what evidence shows that it remains useful.
This register should describe the live website, not merely repeat a cookie policy or an old implementation document. The ICO's current audit guidance recommends identifying the technologies in use, confirming their purposes, removing those no longer needed, checking third parties and data flows, reviewing consent controls and documenting follow-up actions.
Keep, change or remove?
Once the inventory exists, each tool can be given a deliberate outcome.
- Keep it when it has a clear owner, a current purpose, proportionate data use, suitable controls and enough value to justify its impact.
- Change it when the function is useful but the setup is wasteful or too broad. It may load on every page when only one section needs it, duplicate another service or collect more information than the task requires.
- Remove it when nobody can explain its purpose, the campaign has ended, the account is abandoned, the same function exists elsewhere or the company cannot justify the data and dependency it introduces.
Removal should be controlled rather than impulsive. Record a baseline, check which reports or campaigns depend on the service, disable it in a testable way and confirm that forms, purchases, consent choices and measurement still behave as expected. Then remove obsolete code, access and documentation rather than leaving a dormant account behind.
Moving a tag into a server-side system is not the same as removing it. It may reduce work in the visitor's browser, but information can still be collected and shared with external providers. The business purpose, privacy explanation and supplier oversight still need to be clear.
Make the review part of website ownership
The right review frequency depends on how often the website and its marketing activity change. A company running frequent campaigns may need checks far more often than one with a stable brochure website. Useful triggers include a new agency, a platform migration, a consent-platform change, a major campaign ending or a handover between staff.
Third-party tools are easiest to manage when adding one requires an owner, a stated purpose and a review date. That turns the register from a one-off clean-up into a small piece of digital governance. A script should have a reason to exist today, not merely a story about why it was added three years ago.
