DPE-2026-0009

Externe bron inladen

Een bron die rechtstreeks van een derde wordt geladen, maakt van elke paginaweergave een doorgifte.

Familie
Keten
Status
actief
Geldt voor
web

Wat er gebeurt

A font, script library or image is loaded directly from an external provider instead of being served by the site. Each page view sends the visitor's IP address, and often more, to that provider.

Waarom het ertoe doet

It needs no consent interaction to establish and no tracking intent to occur. It happens on the first byte, to every visitor, including those who refuse everything.

Veelvoorkomende oorzaken

  • CDN link copied from documentation
  • theme or template that references external fonts by default

Dit is het níet

This entry is about the mechanism of loading, not about the destination country. Where the data goes is a separate axis; a hotlink within the EEA is still a hotlink.

Hoe je het vaststelt

Indicator

A subresource request to a host under a different registrable domain, present in the initial document, issued without any interaction, in the no-interaction capture.

Methode

network-observed

Kwaliteit van de detectie

90 van 100

De grenzen van deze bevinding

Wat dit patroon zou weerleggen

  • The resource is served locally through a proxy or self-hosted copy.machinaal te toetsende bevinding vervalt
  • The host under the other registrable domain is operated by the controller itself or by a processor on its behalf, and nothing there collects on its own account.met de hand te toetsende bevinding vervaltCommon: a separate asset domain exists to keep cookies off it. Establish it from the name resolution and from who answers, not from the name alone.
  • The resource loads only after the visitor invoked the function it belongs to, such as a map or a video the visitor started.machinaal te toetsende bevinding krijgt een ander patroonThen it is not a transfer on every page view. Whether the invocation was informed is a separate question.
  • The request carries no data capable of identifying the visitor.met de hand te toetsende bevinding wordt zwakkerAn IP address reaches the provider in any case, and under C-582/14 that address is personal data for the operator where legal means to identify the visitor exist.

Wat dit patroon níet vaststelt

  • harm; the catalogue standardises a finding so it can be referred to, it does not weigh it
  • severity; there is no score here, by design. Weighing belongs to whoever applies the entry to a concrete case
  • unlawfulness; that is for a supervisory authority or a court
  • intent; a fault is usually a build decision, not a plan
  • absence: not finding it in one capture is not evidence that it is not there

Reproduceren

  • bookmarkletrepro/bookmarklet/before-consent.bookmarklet.txt
  • scriptrepro/web/check.mjsthe run reports DPE-2026-0009 as present, with the detail behind it

Ook zichtbaar met openbare scanners

urlscan.iowebbkollwebpagetest

Juridisch kader

Bepalingen

eu-gdpr-44eu-gdpr-6-1-a

Rechtspraak

cjeu-breyerlg-muenchen-google-fontscjeu-fashion-id

Veelgehoorde tegenwerpingen

An IP address is not personal data here.

The Court of Justice held in C-582/14 (Breyer) that a dynamic IP address is personal data for the operator of a site where legal means exist to identify the visitor. That is the ground. A German first-instance ruling on hotlinked fonts applied it to this exact mechanism and awarded damages, but it binds nobody and other German courts have gone the other way. Cite it as illustration, never as the ground.

Our hosting is in the Netherlands.

Storage location and loaded components are different things. The transfer runs through what the page pulls in, not through where it is stored.

Geldt wanneer

to-processing

Verwante patronen

← alle patronen