Thank you for the hint, now I am a bit embarrassed that I didn't try to visit the subdomain myself.
I am still worried about it somehow, because in my opinion the most privacy preserving way would be not to fetch that data at all. Now it seems to be down to trust. And the modern web did a good job for me to trust no one anymore. I also don't understand why the element has to 'carry' to the visited site and how that is possible.