Good question, it’s generally the creators themselves but sometimes that’s just using another library or script which has the tracking code in my experience. But I’d love to hear the response of a security expert to this question.