GDPR-compliant websites, built with fewer data paths.
A GDPR compliant website built with Astro ships static HTML by default, so far fewer data paths exist at runtime. What that solves and what it leaves open is on this page. Your data protection advisor gives the legal assessment.
Fewer runtime calls
A prerendered page executes no application code and no plugins when a visitor arrives.
Third parties are decisions
Fonts, maps, videos, analytics and chat are project decisions.
We are not a law firm
We implement what your data protection officer specifies. We do not sign off on compliance.
See what we build.
Mini Marvin is our own progressive web app, designed, built and running live in the browser.
Swipe baby names instead of scrolling
Mini Marvin is our progressive web app for finding baby names: swipe through 10,000+ first names right in the browser, no app store needed.
What we actually change on a website.
-
Six findings, the same ones every time
Fonts from a third-party CDN, maps, videos, analytics, chat widgets, tag managers. All six can be controlled.
More on this
Font files go into the project so they come from your own domain; with licensed typefaces we check whether the licence allows it. Maps and videos get a static preview that loads on click. The Munich Regional Court ruled on 20 January 2022 (case 3 O 17493/20) that dynamically embedded Google Fonts without consent warranted an injunction and damages.
-
Consent takes effect before the first request
If the tracker loads before the click, consent is missing, whatever the banner shows.
More on this
Section 25(1) of the German TDDDG requires consent before information is stored on or read from the terminal equipment. So we take the scripts out of the page head and load them only after documented consent. We verify it in a private window with the network panel open: a third-party domain before the click means the consent tool never took hold.
-
What static delivery leaves open
The default surface shrinks because no plugin code runs per request. What flows is decided by what you embed.
More on this
Astro is MIT-licensed and the generated HTML runs on any web server, including one at a provider you pick yourself, see Astro hosting. Images are produced during the build and come from your domain. For forms, search and personalised areas we switch individual routes to server rendering, which brings log files and IP addresses back into play. We write that down.
-
The evidence you receive
You get a request inventory, a recipient list, third-country exposure, storage locations and retention periods for Article 30.
More on this
Plus the list of Article 28 processing agreements you have to sign and the points with third-country exposure. The adequacy decision on the EU-US Data Privacy Framework of 10 July 2023 covers transfers to self-certified US companies only. If your plan sits behind a login it is a case for custom software development.
We measure what loads before the click.
Send us the URL. You get the list of every domain contacted on a first page view, before anyone clicks the cookie dialog.
GDPR and your website at a glance.
| Question | Short answer |
|---|---|
| Which rules apply? | Two checks: the GDPR for processing personal data, section 25 TDDDG for access to the terminal equipment. |
| When must consent take effect? | Before information is stored on or read from the device. Rejection has to be an equally visible option. |
| Do we have to host in the EU? | The GDPR mandates no EU location. It requires a Chapter V basis for transfers to third countries. |
| What does cookieless measurement change? | It moves the question. Section 25 TDDDG hinges on device access, the GDPR on whether the data is personal. |
| What do we supply as evidence? | A request inventory before and after consent, recipients, third-country exposure, storage locations and retention. |
How a privacy project runs.
Survey
A fresh browser profile, every request logged: without consent, after acceptance, after rejection.
Match to your legal frame
The table goes to your privacy people. We supply the alternative and its price per line.
Set the architecture
Which routes stay static, which need server rendering, where build, repository and CMS live.
Implementation
Fonts into the project, embeds behind a click preview, consent enforcement, the form path tidied.
Evidence and operations
A second measurement against the first, then a recurring check for new domains in the delivery.
Common questions on GDPR, TDDDG and websites.
Is a static website automatically GDPR-compliant?
No. Static rendering reduces the number of places where something can happen at runtime and takes plugin code out of the delivery. Whether personal data is processed is decided by what you embed.
Can a website run without cookies, or does every site need a banner?
Not every site. Section 25(1) TDDDG requires consent for storing and reading information on the terminal equipment, and subsection 2 holds narrow exemptions. A site with no analytics and no marketing scripts often needs far less in practice.
Do we have to host our website in the EU?
The GDPR contains no obligation to host in the EU. It requires a Chapter V basis for transfers to third countries. Conversely a data centre in Frankfurt does not settle the question if access from a third country remains possible.
We received a claim about Google Fonts. Is that a real risk?
The Munich Regional Court ruled on 20 January 2022 (case 3 O 17493/20) that dynamic embedding without consent warranted an injunction and 100 euro in damages. That is one regional court judgment. Technically, putting the font files in the project is enough.
What does a privacy-compliant website cost and how long does it take?
The survey with a report takes one to two weeks, retrofitting an existing site two to five, a new build four to ten. The range moves with the number of third parties, the system connections and the number of approval loops.
Could we run this check ourselves with AI?
A model can read a network list. The work sits in mapping every domain to a purpose, a recipient and a contract. We work AI-assisted ourselves, see the WhatsApp AI agent, and hand over the measurements. Visibility is checked by an SEO audit.
Related pages in the Astro cluster.
What tends to come up next in a privacy conversation:
Do you know what your homepage loads?
We will send you the list of domains contacted on a first page view. Answer usually within 24 hours.
Request a privacy check.
Your URL, a short note on what triggered this, and the open points from your data protection officer.
We usually reply within 24 hours.
Remote and on site in Germany, Austria and Switzerland. International projects on request.
Related services.
Astro Hosting
Where the build, the repository, the CDN and the CMS live, and who can read logs and backups.
Learn moreAstro Integrations
Analytics, forms, maps, CRM: how services get connected without loading unasked.
Learn moreIT Project Management
When privacy, the business side and the vendors need coordinating.
Learn more