Privacy finding
Servers on networks registered outside the EEA are contacted before consent
Privacy Warning Severity: Medium
Part of the audit Trackers and third-party requests. Finding id: privacy.requestsOutsideEeaBeforeConsent.
What it costs you
Data reaches a party outside the EEA before there is consent or any other lawful basis, and the privacy notice may not mention the transfer.
What to do
Load the service after consent, and check that the privacy notice names the transfer and its safeguard.
What it checks
- Non-EU servers contacted before consent
How to fix it
Fix
How to verify by hand
The vendor's data processing agreement and its list of processing locations.
What this relies on
A request to a server outside the EEA before any lawful basis exists may be a transfer under GDPR Chapter V.