Tools and techniques are provided to allow partners of analytics providers and others who use web-beacons to submit plug-ins for scrutiny, and for the plug-in to either be refused or else to be certified for use in a core JavaScript file, data engine, or similar component. Analytics providers and others may also write plug-ins. Certified plug-ins are executed in response to page loads, visitor clicks, and other visitor and programmatic actions at a website that has been tagged by the analytics provider's web-beacon, without requiring re-tagging of the website with a separate web-beacon for the partner. This allows the partner to obtain analytics data by piggybacking on the analytics provider, without re-tagging, and without compromising the availability and accuracy of the analytics data already being gathered. To be certified, web-beacon plug-ins must satisfy specific criteria as to their privacy protection, size, behavior, namespace, and the like.