sus.botdocs

Privacy finding

Third parties the pages contact, when, through whom and where they are based

Privacy Error Severity: High

Part of the audit Trackers and third-party requests. Finding id: privacy.thirdPartyRequests.

What it costs you

Each of these hosts learns that a visitor opened your page, often before the visitor chose anything. You answer for parties you may not know are there.

What to do

For each host: remove it, host the file yourself, or load it only after consent. Name the ones you keep in the privacy policy.

What it checks

  • Other companies contacted before consent
  • Tracking pixel or beacon in use
  • Script that identifies visitors by device
  • Tracker loads further trackers
  • Data sent outside your region
  • Media or fonts loaded from other companies

How to fix it

Make the request wait for consent

    Host fonts yourself and load embeds after a click

    1. Fonts: serve the font files from your own domain.
    2. Video, maps and other embeds: show a placeholder and load the embed after the visitor clicks it.

    How to check: Run this rule again; the host must no longer appear in the 'none' consent state.

    Check where the vendor processes the data

    1. Look up in the contract or the vendor's data processing terms where the data is processed.
    2. Name the vendor and the country in the privacy policy, or replace the vendor.

    How to check: The policy names the vendor and the country. Run this rule again after the next crawl.

    A real case

    A Munich court ruled that a website broke the GDPR by loading Google Fonts from Google's servers, which passed each visitor's IP address to Google without consent. It ordered the operator to stop and to pay the visitor 100 euros in damages.

    Source: Landgericht München I, judgment of 20 January 2022, 3 O 17493/20

    Thresholds

    Thresholds for Third parties the pages contact, when, through whom and where they are based
    NameDefaultMeaning
    region_countries['AT', 'BE', 'BG', 'HR', 'CY', 'CZ', 'DK', 'EE', 'FI', 'FR', 'DE', 'GR', 'HU', 'IE', 'IT', 'LV', 'LT', 'LU', 'MT', 'NL', 'PL', 'PT', 'RO', 'SK', 'SI', 'ES', 'SE', 'IS', 'LI', 'NO']Country codes counted as inside the site's own region. The default is the European Economic Area. Vendors based elsewhere are reported for review.