Approved third parties
Updated
The approved list is your organization’s own answer to “which of these third parties do we expect on our sites?”. This page explains how to turn it on, how it is read, what the findings look like and how to resolve them.
What it is
The Inventory lists the third parties a consent scan saw: before any choice on the consent banner, after Reject all and after Accept all. While the approved list is on, every consent scan compares the third parties it saw on a site with the list and reports each one that is not on it as a finding.
The list holds third-party domains, such as analytics.example. It does not hold URLs, vendors or cookies. An entry matches that domain and its subdomains, so one entry covers www.analytics.example and eu.analytics.example. The Inventory records a third party by its registrable domain, and that is what the list holds. Typing www.analytics.example is therefore refused with “Use analytics.example - the list holds registrable domains”, and so is a public suffix such as co.uk.
The list is off by default. Nothing is reported against it, and nothing on any screen says “not on the list”, until an organization admin turns it on. Once it is on, it stays on. It cannot be turned off again, so decide with that in mind. To quiet a finding, approve the third party.
Turning it on
Go to Settings → Approved third parties. Organization admins can turn it on; every other role can read the list.
- Turn on. The dialog asks how the list starts, and says before you confirm that the list cannot be turned off afterwards.
- Approve everything seen in the latest scan of each site is recommended when your sites already run the third parties you want. It adds every third party the latest scan of each site saw. With two sites or more, a third party seen on every one of them becomes one entry for the whole organization, and the others become entries for the single sites that run them. You can remove any of them afterwards.
- Start with an empty list reports every third party a scan sees until you add it.
Starting from the scans is part of turning the list on: the fill and the switch happen together. Once the list is on, Add what the latest scans saw (on the page, and for one site on its card) adds what the latest scans found since. It is the quick way to approve everything the latest scans saw and quiet the findings. It is not offered while the list is off. Entries you add or edit while the list is off are kept and apply once it is on.
Whole organization or one site
An entry applies either to the whole organization (every site, including sites added later) or to one site.
- Approved for the whole organization: expected everywhere.
- Approved for a site: expected on that site only.
- Left out of a site: approved for the organization, but not expected on this one. A site that leaves a third party out reports it, even though the organization approves it elsewhere.
A site’s list is therefore the organization’s approvals, plus the site’s own, minus the ones the site leaves out. A site’s Approved third parties card (in Site configuration) shows it.
The finding
A third party that a consent scan saw on a site and that is not on that site’s list is one finding for that site, with the third party’s domain in its title:
Third party not on your approved list: analytics.example
Its description says which vendor and category Page Lookout knows it by (or “Unclassified”), on how many pages it was contacted, and when. For a domain that serves several purposes, which the tables leave unclassified but whose owner is known, the description names the owner:
google.com (Unclassified; owned by Google) was contacted on 3 pages, at least once before a consent choice. It is not on your organization’s approved list for this site.
The owner is information about the domain, not a category, and it does not change the finding’s identity: approving the domain closes the finding. The severity follows the scenario, meaning the worst one the third party was seen in:
| Contacted | Severity | The finding says |
|---|---|---|
| at least once after Reject all | High | “at least once after Reject all” |
| at least once before a consent choice | Medium | “at least once before a consent choice” |
| only after Accept all | Low | “only after Accept all” |
The finding keeps the example pages and the other scenarios as evidence. Page Lookout also keeps its existing consent findings for the same third party, for instance a tracker contacted after Reject all. The approved-list finding is about your list, and the others are about the consent choice.
A scan raises at most 200 of these. A scan cut at that cap, or judged over an inventory that was itself incomplete (a page’s record skipped, a row cut), gives a partial judgement. It does not close earlier findings, which show as not checked for that scan, and the next scan cannot tell which of its third parties are new, because it has no complete judgement to compare with.
The finding says “not on your approved list”, which is a fact about your list. It does not say a third party is unwanted or wrongly configured. Whether it is acceptable is for you to judge.
Resolving it
- Approve it. Use Approve this third party on the finding, or Approve on the Inventory row, for the site or for the whole organization. The finding stays open until the next scan of the site and closes then, as resolved, when the scan sees the third party on the list. The screens say “now on your approved list” in the meantime.
- Remove it from the site. When a later scan that is judged against the list no longer sees the third party, the finding closes by itself.
Findings are judged when a scan ends, against the list as it is at that moment. The Inventory’s Approved list column is different: it is worked out when you open the page, against the list as it is now, and its header says “Judged against your approved list as it is now”. So an Inventory row can read Approved while a finding for it is still open. The next scan closes the finding.
Which findings are “new”
“New” means not in the site’s previous finished scan, and a finding can only be new if that scan was judged against the list too. So an alert on new findings behaves like this:
- A site whose very first finished scan happens with the list on has nothing to compare with, so every finding is new and the alert fires on that scan.
- A site that already had scans when the list was turned on: the first scan judged against the list is compared with a scan that was not judged. Its findings are not marked new, they are simply there, and no alert fires for the third parties already on the site. Alerts start with the next scan, for third parties that appear after.
- After a partial judgement (more than 200 third parties not on the list, or an incomplete inventory) the next scan’s findings cannot be compared either, so none is new and no alert fires for that scan.
When the list is off
For an organization that has never turned the list on, nothing is reported against it, and Inventory rows read ”-” rather than “Not on your approved list”. A customer who has not asked for the list should not be told that every third party is a problem.
In the Inventory
The Approved list column on a site’s Inventory tab and on the organization’s Inventory screen reads:
- Approved: on the site’s list. A line under it says “For the whole organization” or “For this site”.
- Not on your approved list: not on the site’s list. A line under it says “Left off for this site” when the organization approves it but the site leaves it out.
- -: the list is off.
The column is on the third-party lists only. Cookies and storage keys are not judged.
On the organization screen, Approved means approved on every site the row appears on, and a row that is not says on how many of its sites (“Not approved on 2 of 5 sites”). Admins have an Approve button on a row, and Stop leaving it out on a row that a site leaves out.
In the CSV files
The two third-party CSV files carry the approval columns at the end. Match by header name, not by position.
| File | Columns added |
|---|---|
a site’s trackers.csv | Approval, Approval source |
the organization’s trackers.csv | Approval, Sites not on approved list |
Approval is approved or not approved, and empty while the list is off. Sites not on approved list is a number, also empty while the list is off. Approval source is organization, site or excluded, and empty when none decides it. The values are those at the moment of the download.
Alerts
An alert rule can tell your organization’s admins when a scan finds a third party that is not on the list. In Alerts → New rule, choose Start from a template → Third party not on the approved list. It fills in a rule of the new or changed findings kind (at least one new finding, at any severity, in the consent module) which you then save like any other. You can build the same rule by hand, and nothing creates it for you.
Narrow Severity to High to hear only about third parties contacted after Reject all, and Watches to one site to limit it. The e-mail says how many third parties were found and when they were contacted. It does not name them: the scan and its findings do, and an admin can approve the ones they expect from there.
Limits and access
- 5,000 entries per organization. “Add several” takes up to 500 per request; a domain already on the list is skipped.
- Admins change the list; every role reads it. A member restricted to some sites reads the whole-organization entries and the entries of the sites they can open.
- Every change to the list is recorded in your organization’s activity.
What it does not say
Page Lookout reports what a scan observed and what your list says. An approved third party is one you said you expect. It is not one that is allowed, that visitors consented to or that meets any rule, and a third party that is not on the list is not thereby wrong. The list is a way to be told when something you did not expect appears.