Third-party cookies: which external domains a page loads

What a third-party cookie is

A third-party cookie is one set by a domain other than the one in the address bar, usually by a script, iframe or image the page loads from an external host. It is the mechanism behind cross-site advertising and session-replay analytics, because the same host sees the same identifier on every site that embeds it.

Browsers have been closing it off, in different ways. Safari blocks third-party cookies outright. Firefox partitions third-party storage per top-level site and blocks known tracking cookies. Chrome kept them behind a user choice rather than removing them. What works everywhere is first-party measurement, server-side collection and consent-gated embeds. Each external domain also has a role under privacy law, as controller or processor depending on what it does with the data, and most of them need consent before they load.

What squirrel checks

The rule runs on every crawled page and inventories external hosts referenced in the HTML. It compares each resource hostname against the page hostname and emits up to three checks:

• tracking-domains warns for hosts it treats as trackers, meaning a host on its known-tracker list or the host of a 0 by 0 or 1 by 1 image that it saw for the first time as that image. Message: 3 known tracking domain(s) detected, listing up to ten entries as hostname (type) where type is script, iframe, pixel, image or script+iframe.
• third-party-resources reports info for the remaining external hosts. Message: 7 other third-party domain(s) found, listing up to five.
• third-party-cookies passes when neither list has an entry. Message: No third-party tracking resources detected.

Scripts and iframes are collected from every script[src] and iframe[src]. Images are only collected when the host is a known tracker or when width and height are both 0 or 1, which is the tracking-pixel shape. A host counts as external unless one hostname contains the other as a substring, and resource URLs that are relative or protocol-relative are skipped because the hostname is parsed without a base URL. The tracking list covers roughly forty domains including doubleclick.net, google-analytics.com, facebook.net, hotjar.com, segment.com, mixpanel.com, clarity.ms and sentry.io, matched on the domain or any parent domain.

No cookies are actually observed. The rule reads markup, so it reports domains that commonly set cookies rather than cookies that were set.

Elements inside <noscript> are skipped: a browser with scripting enabled reads <noscript> content as plain text, so nothing in it loads or renders. See content inside noscript.

How to fix it

<script type="text/plain" data-consent="analytics" src="https://cdn.example-analytics.com/a.js"></script>

Hold third-party tags behind a consent gate. Changing the type on an existing element does not start it, so the consent manager has to create and insert a fresh <script> once the visitor has agreed, which is what the common ones do. For measurement you control, a first-party or server-side collector removes the third-party host entirely.

The info check is an inventory, not a defect. A CDN or font host appears there and needs no action beyond being named in the privacy policy where it applies.

Enable / disable

Disable this rule

[rules]
disable = ["security/third-party-cookies"]

Disable all Security rules

[rules]
disable = ["security/*"]

Enable only this rule

[rules]
enable = ["security/third-party-cookies"]

enable replaces the default ["*"], so this is the only rule selected. Leave disable out: a rule that matches any disable pattern is skipped even when enable names it. Only an enabled setting under a rule’s own [rule_options] table overrides both lists.

Related rules

• security/cookie-flags: the flags on the cookies your own server sets.
• legal/cookie-consent: whether a consent mechanism is present at all.
• analytics/consent-mode: whether Google Consent Mode markers appear in the markup.
• adblock/privacy-blocked: which of these hosts privacy filters already block.

Security findings ship in every audit next to the SEO, performance and agent experience rules. See Website security scan with AI for how an agent works through a report.

References

• Third-party cookies, MDN
• Set-Cookie, MDN

Check your site

Run squirrel audit https://example.com and open the Security section of the report. Every third-party domain is listed by page with the resource type that pulled it in. Signed-out local audits need no account and cost nothing. Signed-in audits spend credits.