What your website loads before anyone has agreed to anything

Of everything discussed under this heading, this is the cheapest measure: no data migration, no training, no resistance from the workforce. One afternoon of work, and a share of your dependencies is gone.

The finding can also be shown rather than asserted. In this debate, that is rare.

The test

Open your website in a browser. Open the developer tools, go to the network tab, reload the page, sort by domain.

Everything listed there that is not your own domain is a connection your visitors' browsers open before anyone has clicked anything. What travels is at minimum the IP address, usually also the page requested and the browser identification.

The findings look similar from company to company: fonts from a font service, a tracking pixel, the map in the contact section, the spam protection in the form, an embedded video that loads before anyone presses play, and two or three code libraries from third-party delivery networks.

The legal position, soberly

In January 2022 the Regional Court Munich I awarded a website visitor 100 euros in damages because a font was loaded dynamically from a US provider. The judgment then triggered a wave of warning letters that was itself assessed as abusive, and it is the decision of a single regional court, not settled case law.

Deriving panic from it is sloppy. So is deriving that the question is closed: the underlying point — transferring personal data requires a legal basis — stands independently of that judgment, and for transfers to third countries the question of the level of protection raised by Schrems II comes on top.

The practical point is a different one anyway: you can remove the connection with two files. The legal assessment then becomes irrelevant, because the facts it applies to no longer exist.

What takes its place

Fonts you serve yourself. Two files in the web directory, one reference in the stylesheet, done. As a side effect the page loads faster, because a connection to a foreign server disappears.

Analytics you replace with a tool that works without personal data — Plausible, Pirsch, or Matomo self-hosted. You lose the link to advertising accounts and fine-grained user tracking. You gain numbers that do not depend on a consent rate, because a tool that needs no consent measures every visit rather than only those of the people who agreed.

Maps you replace with OpenStreetMap tiles, for instance through MapTiler — or, if nobody needs to zoom, with an image and a link. The second option is sufficient more often than people expect.

Spam protection through a method without third-country transfer, such as Friendly Captcha, or through an invisible honeypot field, which is entirely adequate for most forms.

Videos you load only after a click, or you host them on your own instance.

Code libraries you ship yourself instead of pulling them from a foreign delivery network. That is the safer option regardless: what you serve yourself, nobody can swap out in transit.

What the test does not cover

It shows what your visitors' browsers do. It does not show where your site is hosted, who runs DNS resolution, which delivery network sits in front of it, or who issues your certificates. Those four are the next layer, and the questions raised by the US CLOUD Act apply there just as much.

Run the network test first anyway. It takes ten minutes, the result is visible, and in organisations where the debate has been stuck for months, a visible result moves more than the best argument.

The effort

For an ordinary company website: half a day, if somebody has access to the content management system. For an online shop with a grown landscape of extensions: two to three days, because every extension has to be checked individually.

After that, repeat the test once a quarter. Third-party connections come back — with the next marketing tool, the next embedded form, the next extension somebody installs in good faith.