[gsnedders]

My understanding (IANAL) is the site requested (i.e., X) is the data controller: X caused the third-party requests to occur, and is therefore responsible for any data transmitted over them.