Externe bron inladen
Een bron die rechtstreeks van een derde wordt geladen, maakt van elke paginaweergave een doorgifte.
- Familie
- Keten
- Status
- actief
- Geldt voor
- web
Wat er gebeurt
A font, script library or image is loaded directly from an external provider instead of being served by the site. Each page view sends the visitor's IP address, and often more, to that provider.
Waarom het ertoe doet
It needs no consent interaction to establish and no tracking intent to occur. It happens on the first byte, to every visitor, including those who refuse everything.
Veelvoorkomende oorzaken
- CDN link copied from documentation
- theme or template that references external fonts by default
Dit is het níet
This entry is about the mechanism of loading, not about the destination country. Where the data goes is a separate axis; a hotlink within the EEA is still a hotlink.
Hoe je het vaststelt
Indicator
A subresource request to a host under a different registrable domain, present in the initial document, issued without any interaction, in the no-interaction capture.
Methode
network-observed
Kwaliteit van de detectie
90 van 100
De grenzen van deze bevinding
Wat dit patroon zou weerleggen
- The resource is served locally through a proxy or self-hosted copy.machinaal te toetsende bevinding vervalt
- The host under the other registrable domain is operated by the controller itself or by a processor on its behalf, and nothing there collects on its own account.met de hand te toetsende bevinding vervaltCommon: a separate asset domain exists to keep cookies off it. Establish it from the name resolution and from who answers, not from the name alone.
- The resource loads only after the visitor invoked the function it belongs to, such as a map or a video the visitor started.machinaal te toetsende bevinding krijgt een ander patroonThen it is not a transfer on every page view. Whether the invocation was informed is a separate question.
- The request carries no data capable of identifying the visitor.met de hand te toetsende bevinding wordt zwakkerAn IP address reaches the provider in any case, and under C-582/14 that address is personal data for the operator where legal means to identify the visitor exist.
Wat dit patroon níet vaststelt
- harm; the catalogue standardises a finding so it can be referred to, it does not weigh it
- severity; there is no score here, by design. Weighing belongs to whoever applies the entry to a concrete case
- unlawfulness; that is for a supervisory authority or a court
- intent; a fault is usually a build decision, not a plan
- absence: not finding it in one capture is not evidence that it is not there
Reproduceren
- bookmarklet
repro/bookmarklet/before-consent.bookmarklet.txt - script
repro/web/check.mjsthe run reports DPE-2026-0009 as present, with the detail behind it
Ook zichtbaar met openbare scanners
Juridisch kader
Bepalingen
Rechtspraak
Veelgehoorde tegenwerpingen
An IP address is not personal data here.
The Court of Justice held in C-582/14 (Breyer) that a dynamic IP address is personal data for the operator of a site where legal means exist to identify the visitor. That is the ground. A German first-instance ruling on hotlinked fonts applied it to this exact mechanism and awarded damages, but it binds nobody and other German courts have gone the other way. Cite it as illustration, never as the ground.
Our hosting is in the Netherlands.
Storage location and loaded components are different things. The transfer runs through what the page pulls in, not through where it is stored.
Geldt wanneer
to-processing