What transfers to third countries mean
If your page loads something from a provider outside the EU and EEA, the visitor's IP address goes to a third country. That needs a legal basis, and before consent it should only happen when it is really necessary.
How it works
The GDPR applies in the EU and the EEA, which adds Iceland, Liechtenstein and Norway. Every other country is a third country. Under Articles 44 et seq. of the GDPR, personal data may only go there on one of these bases:
- An adequacy decision by the European Commission (Article 45), confirming that the country offers a comparable level of protection. Such decisions exist for Switzerland, the United Kingdom and Japan, among others. For the USA, the EU-US Data Privacy Framework has applied since July 2023, but only to companies certified under it.
- Appropriate safeguards (Article 46), usually the Commission's standard contractual clauses, together with an assessment of whether they can be honoured in the destination country.
Merely loading a font, a video or a script sends the IP address to the provider. If the provider sits in a third country, that is a transfer.
bytereport lists every known provider based outside the EU and EEA that something loads from before consent. The consent tool itself does not count, nor does anything needed to run the site, such as for a payment.
What matters
- The finding is something to check. bytereport also lists providers from countries with an adequacy decision. Whether the transfer is lawful depends on its basis, not on the country alone.
- Does it have to load before consent? Often there is no reason: you can serve fonts yourself and load videos and maps on a click (see external content).
- Check the certification. Whether a US provider is certified under the Data Privacy Framework is shown in the public list at dataprivacyframework.gov.
- Contract partner and data flow. Even if your contract is with an EU subsidiary, data may still go to the parent company. The data processing agreement or the provider's privacy notice says so.
- Transparency. Every transfer to a third country belongs in the privacy policy together with its basis.
How to set it up
Go through the list in the report service by service. Anything that need not load before consent is set in the consent tool or tag manager to load only afterwards; where needed, replace the service with a provider in the EU. For the services that remain, whoever is responsible for data protection in your organisation clarifies the basis of the transfer and the contract with the provider.
This is not legal advice; your data protection officer or a lawyer decides the individual case.