Google Fonts & GDPR Embed Check - Find US Calls Before Consent

Opens a website the way a first-time visitor sees it, without touching the cookie banner, and lists every third-party server the page contacts on its own (Google Fonts, reCAPTCHA, YouTube, Maps, analytics, ad pixels, CDNs) with the operator, its country and a fix. For German and EU site owners, agencies and consultants: audit one site, or the whole website column of a Google Maps dataset to build a lead list of sites that need fixing.

Input examples

One site:

{ "urls": ["https://www.example.de/"] }

A whole local-business list from a Google Maps scraper run (pick the dataset in the form, or pass its id):

{ "datasetId": "YOUR_MAPS_DATASET_ID", "websiteField": "website", "maxUrls": 100 }

EU view with a German Apify proxy (banners and defaults often differ outside Europe):

{ "urls": ["https://www.example.de/"], "proxyConfiguration": { "useApifyProxy": true, "apifyProxyCountryCode": "DE" } }

Input guide

Field	Meaning
urls	Pages to audit (home pages are usually enough).
datasetId, websiteField	Dataset (for example Google Maps scraper output) and the column holding the website. Social-media links are skipped, duplicates removed.
maxUrls, concurrency, settleSeconds	Size and speed. About 15-25 s per site.
locale, proxyConfiguration	Browser language and optional Apify proxy.

Output (one row per site)

Field	Meaning
verdict	RISK (a recipient outside the EU/EEA was contacted before consent), REVIEW (unknown/medium third parties or tracking-like cookies), CLEAN
googleFontsBeforeConsent	Google Fonts requested by the page itself
recipients[]	host, company, country, category (fonts, captcha, maps, video, analytics, advertising, cdn...), risk, requests, exampleUrl, fix
recipientCountries, thirdPartyHostCount, thirdPartyRequestCount	Totals
consentPlatformDetected	Cookiebot, OneTrust, Sourcepoint... when its script is loaded
trackingLikeCookies[]	Cookies set before consent whose names look like tracking
fixes[]	Plain instructions, for example self-host Google Fonts

Sample row (shortened):

{ "type": "page", "url": "https://www.w3schools.com/", "verdict": "RISK", "riskyRecipientCount": 3, "googleFontsBeforeConsent": false,
  "recipients": [ { "host": "analytics.google.com", "company": "Google LLC", "country": "US", "category": "analytics", "risk": "high",
  "fix": "Load Google Analytics only after consent, or switch to a self-hosted / EU analytics tool." } ] }

Use it with

Google Maps scraper -> this Actor -> filter verdict = RISK -> outreach list. Pair with consent-mode-v2-checker and gpc-opt-out-checker for an EU + US privacy pack.

FAQ

What does "country" mean? The country where the operator of the endpoint is established (a built-in list of about 90 well-known services; other hosts get a TLD guess or unknown). It is not a server geolocation.

Is a US recipient illegal? Not necessarily. Many US companies are certified under the EU-US Data Privacy Framework. A hit means "check your legal basis and consent", it is not legal advice.

Why does a site show no banner? Many banners appear only for visitors from Europe. The Actor runs from a US datacenter by default; set an EU proxy for the EU view.

Honest limits

One anonymous visit of the exact URL given; requests that only happen after a click or on other pages are not seen. Unknown hosts are listed as review. Pages that block datacenter IPs come back as free error rows. Public pages only, no logins.

Price

$0.003 per page audited (page-audited); errors are free. Example: 100 sites from a Maps list = $0.30.