Isn't the site owner in charge of GDPR for the site? Aren't they already non-compliant by hotlinking a resource from someone where there's no agreement about personal data? Wouldn't it still be the site owner's responsibility not to let a 3rd party send even more personal data over?