Project 15 - GDPR

Normally, when a site visitor goes to a web site that loads a font or image, etc, from another web site, that visitor's IP address is sent to those sites so that they can monitor who and where the demand is coming from. The phrase "No such thing as a lunch" bears home here, because the "free" service can be considered a monitoring service or as a potential way to fund growth based on users of the service. Before GDPR, we were not too bothered by this issue, but post GDPR, it is one of the main issues being taken very seriously by many.

At the centre of the current debate about how best to make a web site GDPR compliant, is that when an external call to a font, video, image or icon service is made, whether the web sites visitors IP address sent to these sites, can identify the user. It is undeniably, one piece of the identity puzzle and your service provider can certainly identify you from your IP address. You then depend on your service provider protecting your data and unfortunately every country has one or more examples of huge data breaches, e.g. in the UK, the service provider TalkTalk. The Court of Justice of the European Union has held that IP addresses are "personal data" in certain circumstances as documented here. This topic is often debated and is often denied by those who have a dependancy on external calls or have a degree of work to do to avoid external calls.

However, this debate is somewhat irrelevant, because it is web site visitor who will decide what's safe and what is not safe. The last thing that any web site owner wants, is for a visitor to consider a web site unsafe or non compliant, by demonstrating an ineffective privacy policy, and as a result, decline to visit that site. This applies worldwide and will will become more relevant as the world continues to tighten up on privacy and data protection and more scare stories emerge about data breaches and data misuse.

The solution taken by this web site is simple. I.e. avoid all calls to other web sites so that there is no grey area whatsoever. If you are building sites for others who may not fully understand the issue, the grey area needs to be avoided, because you don't want them coming back to you accusing you of building a non compliant web site.