How external content loads only after consent

How it works

When your page embeds something from another server, the browser fetches it from there directly. The provider learns the visitor's IP address, the page the request comes from and details about the browser. This happens while the page loads, before anyone has chosen anything in the banner.

Typical cases are Google Fonts, embedded YouTube videos, Google Maps, captchas such as reCAPTCHA, scripts and libraries from a CDN (content delivery network) and Google Tag Manager. The IP address is personal data. Under the GDPR the transfer needs a legal basis: consent, or a legitimate interest that outweighs the visitor's. If the content could just as well be delivered without the other server, a legitimate interest rarely holds.

bytereport counts everything that loads from another website before consent and is neither tracking (a check of its own), nor the consent tool, nor needed to run the site, such as for a payment.

What matters

• Serve what you can yourself. Fonts, JavaScript libraries and icons go on your own server. Nothing changes for visitors, and no request leaves your site.
• Two-click solution for videos and maps. Instead of the player, the page shows a preview image with a notice; only a click loads the content from the provider. YouTube's “privacy-enhanced mode” (youtube-nocookie.com) also loads from Google's servers as soon as the page opens.
• Providers outside the EU weigh more. If something loads before consent from a provider based outside the EU and EEA, bytereport rates it as an error, otherwise as a warning. More under third countries.
• Captchas and logins. A captcha or a social login button does not have to load with the page. Load it once someone uses the form or the button, or pick a provider based in the EU.
• Name it in the privacy policy. Whatever loads after consent belongs in the privacy policy with its purpose and recipient.

How to set it up

Many themes and page builders have a setting to load fonts locally; otherwise download the font files and include them via CSS from your own server. Replace libraries from a CDN with your own copies. For videos and maps, most consent tools offer placeholders for the two-click solution that you switch on per service. Whoever looks after the website does this in the CMS, the theme or the consent tool.

Then check the network tab of the developer tools in a private window: before the click in the banner, requests should only go to your own domain and to the consent tool.

This is not legal advice; your data protection officer or a lawyer decides the individual case.