gdpr
How can consent-banner as a service be GDPR compliant?
<p>A couple of months ago I've read that hosting google fonts on your own server is a better but maybe slower solution as loading content from google servers is already something that the users must be informed about due to submitting your IP to google.</p>
<p>Now I am realizing that basically the same thing is true for consent services that host the entire experience on their servers and give users only the service, am I right?
They all claim they are safe to use, but I fail to understand how so.</p>
<p>I was testing a consent service that requires me to basically load their cloud hosted javascript code:</p>
<p><code>&lt;script type=&quot;text/javascript&quot; charset=&quot;UTF-8&quot; src=&quot;https://cdn.cookie-consent-provider.com/&lt;SOME-ID&gt;.js&quot;&gt;&lt;/script&gt;</code></p>
<p>Now I can't get my head around whether this is already some sort of non-compliant GDPR behaviour because even if this provider would do everything to protect the data and be compliant, etc, I still would have to establish a connection to their servers first, in order to be able to inform the users because in some cases self-hosting this service is not possible due to a paywall or not-available at all.</p>
<p>So basically</p>
<ol>
<li>loading my website</li>
<li>script loads cookie consent from remote server</li>
<li>cookie consent is displayed</li>
</ol>
<p>would be invalid because the user could not decide, nor decline step 2? He or she would send their IP to the remote address without consent.</p>
<p>The fun part is: What if the consent banner has no way of declining step 2.? I mean, this is weird because you would decline consent to access the consent servers.</p>
<p>§6 <a href="https://gdpr-info.eu/art-6-gdpr/" rel="noreferrer">https://gdpr-info.eu/art-6-gdpr/</a> states that consent is required and if this is true, then no consent service unless self-hosting would actually be compliant?</p>
<p>Where am I wrong?</p>

<p>The critical part is the nature of the relationship between you, the website provider, and the provider of the material you embed.</p>
<p>If the embed-provider acts as your <strong>data processor</strong>, then things are generally fine. The GDPR does not really distinguish between personal data processing activities that you perform yourself versus activities that you've outsourced to third parties. However, you would remain responsible for compliance. This also means that per Art 28 GDPR, you will need a contract with that embed-provider (sometimes called a “Data Processing Agreement”, DPA). This contract stipulates that the processor will only use the personal data as instructed by you, but not for their own purposes.</p>
<p>With the Google Fonts case, it must be highlighted that Google does not act as a processor for this service. Google does not offer a DPA that covers the Fonts CDN. While Google <em>promises</em> that it doesn't use the personal data collected in this context in any nefarious way, there are zero contractual guarantees for website providers.</p>
<p>So we have to consider the scenario when the embed-provider is an <strong>independent data controller</strong>. We as the website provider have no control over what the embed-provider does with the collected data, our control only extends to whether or not we cause the website to disclose data to that third party. But this is still processing as personal data (see also the CJEU <em>Fashion ID</em> case), and we need a legal basis for this data sharing.</p>
<p>In the Google Fonts case, the court in Munich found that there was no legal basis for using Google's CDN. There was no consent, no contractual necessity, and no necessity for a legitimate interest. After all, these fonts could all be self-hosted.</p>
<p>(Technical remark: and given how modern browsers enforce cache isolation and provide HTTP/2, serving fonts from your main domain is probably faster anyway).</p>
<p>Consent management services will typically act as your data processor. You don't need a legal basis for “sharing” data with them, because the processing remains under your control. As far as the GDPR is concerned, loading a script from your processor's servers is equivalent to loading a script from your own servers (which you're probably hosting via a another data processor anyway). Sometimes, the necessary data processing agreement is already part of the standard terms of service, sometimes it's a separate document that has to be signed. Figuring this out is your responsibility as the data controller, before deploying the service.</p>
<p>Art 6 GDPR doesn't say that you always need consent. It says that you need a legal basis, for which paragraph 1 enumerates six choices. For a lot of use cases, a “legitimate interest” will be appropriate, though it requires a balancing test. Sometimes, other laws mandate that you use a particular legal basis. For example, the ePrivacy Directive says that you must get GDPR-consent when accessing or storing information on the user's device (such as cookies), unless that access/storage is strictly necessary to provide a service explicitly requested by the user.</p>
