Third-party content is embedded on the page
This page embeds content that loads from a third party (for example a video, a map, or a chat widget).
Why it matters
This page embeds content that loads from a third party (for example a video, a map, or a chat widget). These embeds can set cookies and receive the visitor's IP address and page context as the page loads, before any consent choice. Where a privacy-preserving variant exists, prefer it — e.g. youtube-nocookie.com instead of youtube.com — or use a click-to-load facade that only fetches the embed after the visitor interacts with it. (The embeds found are listed in this finding's evidence.)
How ShipReady detects it
Per-page privacy signals read straight from the fetched HTML and response headers — no extra requests. Page-scoped because trackers, cookies and forms genuinely differ between routes (a marketing homepage vs a bare /login), and the route that carries the signup form is exactly the one worth seeing.
Detection is deterministic. ShipReady reports this only when it observes the condition directly, and prefers to miss a real problem over inventing one. Rule version 1.0.0.
How to fix it
This is the prompt ShipReady puts in your report — written to be pasted straight into Cursor, Claude Code, or whichever assistant built the app.
This page embeds third-party content (a video, map, chat widget, or similar) that loads directly from the provider, so it can set cookies and send the visitor's IP address to that provider as the page loads — before any consent choice. First, prefer a privacy-preserving variant where one exists: swap youtube.com embeds for youtube-nocookie.com, and check whether your map or chat vendor offers a cookieless mode. Second, for anything below the fold or non-essential, use a click-to-load facade (show a lightweight placeholder image and only load the real embed when the visitor clicks it) — this also speeds up the page. Third, if the embed is non-essential and set to load on page load, gate it behind your consent banner. This is a privacy-hygiene improvement, not legal advice; confirm your own obligations for your audience.
Frequently asked questions
- What does "Third-party content is embedded on the page" mean?
- This page embeds content that loads from a third party (for example a video, a map, or a chat widget).
- How serious is it?
- ShipReady rates this low. Worth fixing. Small individually, and they accumulate.
- How do I fix it?
- Paste the fix prompt on this page into Cursor, Claude Code or your AI editor. It is the same prompt ShipReady puts in your report.
- Can I check my own site?
- Yes — ShipReady scans up to ten pages of any public site for free and reports this alongside every other check. The free report lists every issue it finds and shows full evidence and a fix prompt for the critical and high-severity ones; medium and low findings are counted and unlock on Pro.
Related checks
- A device-fingerprinting script is presentmedium
- A form collecting personal data submits via GETmedium
- Session-replay or behaviour-recording script is presentmedium
- Tracking cookie is set before the consent banner can be answeredmedium
- Tracking cookie is set on the first responsemedium
- Analytics or advertising tracker loads without a detected consent steplow
Run this check on your site
ShipReady checks this and 193 other things across up to ten pages of your site, with an AI-ready fix for each. Free, no signup.