In this blogpost we ask if website owners must inform about all 3rd parties on their websites in response to website visitors' Access Requests?

We will explain how Trackerdetect automatically detects and builds information about 3rd parties on your website to help you respond to your website visitor's Access Request in GDPR Article 15.

In the following it is assumed that

  • you have 3rd parties on your site, and
  • the personal data of your website visitors are disclosed to the 3rd parties on your site.

Confirmation Response

If you are a website owner, you can ask yourself

“Must I respond to my website visitor's request confirmation that I process his/her personal data?”

The answer is yes.

Most site owners process the personal data of their website visitors.

If your website visitor requests confirmation that you process his/her personal data, then you must respond and confirm that you do so.

This is the rule in GDPR Article 15.1.

(Additionally, you must respond within a time limit and with a proper language, as required by GDPR Article 12).

In an upcoming blogpost, we will show how you can automatise your access request responses.

Confirmation Response Information

If you also ask yourself

“Must I in my Confirmation Response (to my website visitor's request for confirmation that I process his/her personal data) include information about 3rd parties on my website?”

The answer is yes.

Site owners must include in the Confirmation Response the recipients or categories of recipients of website visitors’ personal data.

This is the rule in GDPR Article 15.1(c).

Confirmation Response Information: naming actual recipients

If you additionally ask yourself

“Must I in my Confirmation Response (to my website visitor's request for confirmation that I process his/her personal data) include the names of the actual 3rd parties on my website?”

The answer is yes.

Site owners must include in the Confirmation Response the name of the recipient of website visitors’ personal data. The term “recipient” (GDPR Article 4.9) includes

  • data controllers
  • joint controllers
  • processors to whom data is transferred or disclosed
  • third party recipients

This is the rule in GDPR Article 15.1(c).

The WP29, says (concerning the same expression (“the categories of recipients”) in GDPR Article 13.(e) and 14.1(e)) that “in accordance with the principle of fairness, the default position is that a data controller should provide information on the actual (named) recipients of the personal data.”

How can Trackerdetect help?

With Trackerdetect you can automatically detect all 3rd parties on your site

  • at a given time by manual clicks
  • at given intervals, e.g. each 6th hour
  • from a given location
  • and store the information about the 3rd parties in a record with Signatu
  • and include such information in your Privacy Policy by a one-click
  • including information about their
    • legal entity
    • contact details
    • categorization of each 3rd party
    • description of each 3rd party's service
    • links to website privacy policy, service policy and cookie policy with date it went into effect or date of last version (if any)
    • links to opt-out method(s) (if any)

Confirmation Response Information: naming categories of recipients

If you also ask yourself

“Can I in my Confirmation Response (to my website visitor's request for confirmation that I process his/her personal data) include only the name of the categories of the actual 3rd parties on my website?”

The answer is yes.

Instead of naming the actual recipients, site owners can include in the Confirmation Response only the name of the categories of recipients of website visitors’ personal data.

This is the rule in GDPR Article 15.1(c).

WP29, says (concerning the same expression (“the categories of recipients”) in GDPR Article 13.(e) and 14.1(e)) that where one opts only to provide the categories of recipients the information on the categories of recipients should be as specific as possible by indicating the type of recipient, i.e. by reference to

  • the activities it carries out
  • the industry
  • sector
  • sub-sector
  • the location of the recipients

How can Trackerdetect help?

With Trackerdetect

  • you can find out what the detected 3rd parties typically do
  • the detected 3rd parties are grouped together under categories made by signatu, such as website analytics, marketing etc.

Confirmation Response Information: use purposes

If you also ask yourself

“Must I in my Confirmation Response (to my website visitor's request for confirmation that I process his/her personal data) include information about the purpose for which I use 3rd parties on my website?”

The answer is yes.

Site owners must include in the Confirmation Response “the purposes of the processing”.

This includes the purpose for which you use 3rd parties on your website, e.g. website analytics.

This is the rule in GDPR Article 15.1(a).

How can Trackerdetect help?

With Trackerdetect you can find out why you typically use a detected 3rd party.

Confirmation Response Information: transfers outside the EU

If you ask yourself,

“Must I in my Confirmation Response (to my website visitor's request for confirmation that I process his/her personal data) include information about the transfer of my website visitors’ personal data to a country outside the EU where the 3rd parties on my website are?”

The answer is yes.

Site owners must include in the Confirmation Response “transfers of personal data to a third country or an international organisation”, including

  • the identifi­cation of that third country or international organisation
  • the appropriate safeguards pursuant to Article 46 relating to the transfer.

This is the rule in GDPR Article 15.2.

How can Trackerdetect help?

With Trackerdetect you can find out the URL of the 3rd party and determine the physical location of the IP address of the URL domain name. From the transmission of website visitors' data (between the URL of the website and the URL of the 3rd party) it is inferred that website visitors' data are transferred or not transferred between countries as well as from the EU to a third country.

We could go on and comment about other requirements to inform website visitors in your Confirmation Response (to your website visitor's request for confirmation that you process his/her personal data) (GDPR Article 15), however the main point in the above is to describe how Trackerdetect can assist you in making a Confirmation Response with information about 3rd parties that are on your site, as required by GDPR Article 15.

Other blogposts on Trackerdetect

In other blogposts about Trackerdetect on

we have explained reasons why you should become aware of 3rd parties on your site and how Trackerdetect automatically detects and builds a record of 3rd parties that are on your website to

  • help you meet the record keeping requirements in GDPR Article 30.1.
  • help you meet the information and transparency requirements in GDPR Article 13.
  • help you respond to your website visitor's Access Request in GDPR Article 15.
  • equip you with their contact details so you can communicate to those 3rd parties that your website visitor requests to exercise his/her right.
  • enable you to classify 3rd parties to determine whether or not you are required to enter into an agreement with the detected 3rd parties, as required in GDPR (data processing agreement (GDPR Article 28), joint controller agreement (GDPR Article 26), controller to controller agreement).
  • help you identify all 3rd parties on your website so that you can assess whether your website-3rd parties' processing operations pose risks to the rights and freedoms of your website visitors and whether a DPIA is necessary, in accordance with GDPR.
  • help you understand how 3rd parties appear on your website so that you can adopt internal data protection policies for having 3rd parties on your website, as required by GDPR Article 24.
  • help you to identify whether unauthorised disclosure of your website visitors’ personal data have occurred and whether you need to notify the personal data breach to the supervisory authority and your website visitors.
  • help you to be able to demonstrate that you have the technological measures to detect and record 3rd parties on websites, as required by the GDPR Articles 24.1, 30.1(d) and Recital 87.

Reach out to us

If you have an interest in Trackerdetect, please send us an email to hello@signatu.com.