[toast0]

Isn't the site owner in charge of GDPR for the site? Aren't they already non-compliant by hotlinking a resource from someone where there's no agreement about personal data? Wouldn't it still be the site owner's responsibility not to let a 3rd party send even more personal data over?

[tantalor]

The code is fetched from your domain, you are responsible for what it does and what you are collecting.