GDPR-Compliant Websites Built with Astro

01 — In short

GDPR and your website: the short version.

In short

Two rulebooks, not one: the GDPR governs the processing of personal data. Storing information on, or reading information from, a visitor’s device is governed separately in Germany by § 25 TDDDG, the law formerly known as TTDSG. Each gets its own assessment.
Static is not compliant: a prerendered site makes far fewer runtime calls and runs no plugin code per request. The surface shrinks. Whether personal data flows still depends entirely on what you embed.
The findings are always the same six: fonts from a third-party CDN, map embeds, video embeds, analytics, chat widgets, tag managers. Six suspects – and every one of them is replaceable or controllable.
Consent has to bite first: a banner that appears while the tracker has already loaded is decoration. We build so that no request leaves for the third party before consent exists.
Hosting is about access, not only location: the GDPR does not mandate EU servers. It requires a Chapter V basis for transfers to third countries. A data centre in Frankfurt does not answer that question on its own.
Evidence instead of assertion: we supply the technical input for your record of processing activities – every outbound request, every recipient, every storage location. You are the one who signs it.

02 — Findings

Where websites actually leak.

In every first call we open the network tab and load your homepage in a clean private window without clicking anything. Whatever has already left the browser before the cookie dialog even rendered is the real finding. These six show up in almost every project.

The font that phones home

A web font fetched from a provider’s server transmits the visitor’s IP address to that provider in the process. In Germany, the Regional Court of Munich I ruled on 20 January 2022 (case 3 O 17493/20) that embedding Google Fonts dynamically without consent warranted an injunction and 100 euros in damages. That is a single first-instance decision, not settled higher-court law – but it is the reason we self-host fonts as a matter of routine.

The banner that arrives too late

A great many consent tools display a dialog after the scripts in the document head have already loaded. Technically, consent was then collected after the thing happened. § 25 (1) TDDDG requires consent before information is stored on or read from the visitor’s device.

The tag manager as a blind spot

A tag manager moves control over which scripts load out of the repository and into a web interface that non-technical people can publish from. It is convenient, and it is the most common route by which a third party ends up on a site without appearing in anyone’s processing records.

Maps and video as default furniture

One iframe for directions, another for the brand film: both open a connection to the provider the moment the page loads, whether or not anyone ever touches the map. Both can be replaced by a preview that only loads on click, after consent.

The form with no known recipient

Contact forms surprisingly often run through a service somebody set up once. Which fields are stored, where they sit, for how long, and who else has access is frequently unknown by the time anyone asks. This is the question that subject access requests tend to break on.

Responsibility that does not stay with the vendor

The Higher Regional Court of Frankfurt am Main held on 11 December 2025 (case 6 U 81/23) that a third-party vendor whose technology sets cookies on someone else’s site can itself be a provider under § 25 TDDDG and be liable for an injunction and damages. That does not move responsibility away from you – it means several parties can carry it at the same time.

03 — Architecture

What a statically served site changes – and what it does not.

The technical argument is real, and it is bounded. We say both halves, because the second one usually matters more than the first.

No application code per request – With Astro, the entire site is prerendered by default and static HTML pages are sent to the browser. There is no application executing plugin code on page view, no database query, and no extension marketplace through which a script can reach the delivered page. What ships came out of the build – and can be read back in the repository.
No client-side JavaScript until something asks for it – Astro removes all client-side JavaScript from components by default. Interactivity is switched on per component via a directive – immediately, when the browser goes idle, or once the component scrolls into view. The side effect matters here: every script running in the visitor’s browser is a deliberate line of code rather than a default.
The output runs anywhere – Astro is open source under the MIT license. The HTML it produces can be served from any web server – including a machine at a German provider, a data centre you pick, or your own network. There is no platform that necessarily sees your visitors along the way. More on that on our Astro hosting page.
Images and fonts from your own host – Built-in image handling produces the image variants during the build, so they are served from your own domain; remote images have to be allowed explicitly in the configuration. Fonts go into the project as files. Both sound mundane, and together they are the reason no third-party domain is contacted on a first page view.
Honest: rendering is not a legal position – A static page can carry a tracking pixel, a chat widget and three ad networks just as well as any other page. Anyone selling static delivery as a privacy argument without auditing the embeds is selling a feeling. The benefit lies in the smaller default surface, not in a property you could cite.
Honest: some things have to stay dynamic – Form processing, search over user input, personalised areas: for those we switch individual routes to on-demand rendering. That brings a runtime back into play – and with it log files, IP addresses and a processing activity that has to be described and justified. We show that openly in the project instead of hiding it under the word “static”.

The legal frame

GDPR for processing personal data, § 25 TDDDG for access to terminal equipment. For breaches of § 25 (1) sentence 1, § 28 TDDDG provides for fines of up to 300,000 euros.

Not legal advice

This page is a technical account, not legal advice. Assessing your specific case belongs to your data protection officer or a law firm.

What we deliver

Implementation, measurement and documentation. Which requests a page triggers, to whom, carrying what – and what it costs to get rid of them.

04 — Implementation

What we actually build.

Six work packages. Bookable individually for an existing site, or as part of a new build – in which case they are set from the first commit instead of retrofitted later.

Self-hosted fonts

Font files live in the project and are served from your domain. No request to a third-party CDN, no IP address handed to anyone while the page renders. For licensed typefaces we check first whether the licence covers self-hosting – that comes up more often than people expect.

Performance & assets

Consent that actually blocks

Third-party scripts do not sit in the document head. They load only after documented consent. Categories and wording come from your data protection officer; we build the technical enforcement and prove in testing that nothing leaves before consent.

Integrations

Measurement that fits your legal frame

We lay the options side by side: consent-gated analytics, self-hosted analytics, server-side measurement, plain log file analysis. Each with what it costs you in insight and what it adds in review effort – and without claiming that any of them is inherently consent-free.

SEO audit

Embeds on click only

Maps, videos, social walls and booking widgets get a static preview served from your own domain. The connection to the provider is created when someone actively clicks and consent is in place. Visually the difference is small. Technically it is the entire point.

Embeds & services

Hosting and build chain

Where the build runs, where the repository lives, where the CDN sits, where the CMS sits, who can read the logs. We map the whole chain and set it up the way your legal frame requires – up to a server at a provider you choose yourself.

Astro hosting

Documented form paths

From submit to inbox: which fields, which transport, which recipient, which retention period, which deletion point. We make the path as short as possible – ideally your domain, your inbox, your CRM – and write it down instead of guessing at it later.

CMS & data paths

05 — Evidence

Evidence instead of assertion.

The difference between a site that is built privacy-first and a site that can also prove it is documentation. That input is part of what we deliver.

Article 30 GDPR requires a record of processing activities. The relief for organisations with fewer than 250 employees rarely helps in practice, because it only applies where the processing poses no risk to the rights of data subjects, is occasional, and involves no special categories of data. A website that runs permanently and receives contact enquiries is not processing occasionally. Most of our clients therefore keep a record – and the part of it that concerns the website is the part we can fill in.

What we assemble for that is not a legal assessment. It is a technical inventory with evidence attached:

Request inventory. Every domain a page contacts, separated into “before consent” and “after consent”, with the trigger and the purpose. Produced from an actual page load, not from a list of installed tools.
Recipient list. Which provider receives which data, in which role, on which basis – and whether a data processing agreement under Article 28 GDPR exists for it. Where one is missing we say so; concluding it is your job.
Third-country exposure. Wherever the chain touches a provider outside the EU, we name it. The GDPR does not prohibit such transfers; it requires a basis under Chapter V, such as an adequacy decision or standard contractual clauses. Which basis you rely on is decided with your legal advisers.
Storage locations and retention. Form submissions, log files, CMS content, backups, build artefacts. A purpose and a period for each location – including the cases where the period ends up being “until revoked” and is justified as such.
Technical measures. Transport encryption, access roles in the repository and the CMS, mandatory two-factor authentication, separated environments, retained deployment history. That is the input for your description of technical and organisational measures.

One side effect of the build style: because Astro keeps content and configuration in the repository and every change lands as a commit, you can establish for each embedded third party when it arrived and who added it. That is not a legal position, but it answers the least comfortable question in any review: how long has this been running?

On the transatlantic question, because it comes up in nearly every conversation: the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework on 10 July 2023. It covers transfers to US companies that have self-certified under the framework and appear on the US Department of Commerce list – it does not cover recipients who have not. The General Court of the European Union dismissed an action for annulment against that decision on 3 September 2025, and the appeal against that judgment is pending before the Court of Justice. So the decision stands, and a residual risk is on the record. How you handle that is a risk decision for your organisation. Our job is to make sure you can take it at all, because the affected services are named and built in so they can be swapped.

Article 30 GDPR

Record of processing activities. We deliver the website portion as ready-to-use input – purposes, recipients, storage locations, retention periods.

Article 28 GDPR

Processor agreements. Hosting, CDN, CMS, form service and analytics each need one. We tell you which are required.

Chapter V GDPR

Third-country transfers. An EU server location alone does not settle the question when access from a third country is technically possible.

The boundary

We supply facts and evidence. The assessment and the signature stay with whoever carries data protection responsibility on your side.

06 — How we work

How a privacy engagement runs.

The same sequence whether it is a new build or a retrofit. After step two you know what needs doing – even if you then do it yourselves.

Inventory

We load your site in a fresh browser profile and log every outbound request, every cookie set, every local storage entry – once without consent, once after accepting, once after rejecting. The result is a table, not an opinion. Takes a few days.

Match against your legal frame

The table goes to your data protection officer or your counsel. They decide what requires consent, what goes, and what stays. For each item we supply the technical alternative and its price, so the decision is not taken in the abstract.

Fix the architecture

Which routes stay static, which need on-demand rendering, where the build runs, where repository and CMS live, who has access. That determines both running cost and review effort later – which is why it comes first and not in a deployment ticket.

Implementation

Fonts into the project, embeds behind click previews, consent enforced before the first request, form path cleaned up, analytics per the decision from step two. All in the repository, all as reviewable commits, all verifiable in a preview environment before go-live.

Produce the evidence

A second measurement after implementation, held against the first. From that comes the input for your record of processing activities and the list of agreements you still need to conclude. Whatever remains open is listed as open – not as done.

Operation

Third parties come back. A campaign script, a new tool, a plugin in the CMS. We set up a recurring check and report when a new domain shows up in what is served. That is part of our maintenance, or one appointment per quarter.

07 — Time & cost

How long this takes – and what moves the price.

As a frame: the inventory plus written report takes one to two weeks. Retrofitting an existing site – fonts, embeds, consent enforcement, form path – runs two to five weeks. A new build with Astro that plans for all of it from the outset runs four to ten weeks. Those ranges are experience values for implementation effort, not a commitment; which end of the range applies is set by the six variables below. We name prices after the first call, and then as a traceable estimate with the assumptions written out.

Number of third parties – Three embeds are an afternoon. Twenty grown-over-time embeds are a project – mostly because each one comes with the question of who needs it and who is allowed to remove it. The technical part is rarely the expensive part.
Review loops – When the data protection officer, outside counsel, marketing and the works council all weigh in, their calendars set the duration, not ours. We plan for that openly instead of complaining about it afterwards.
Condition of what exists – A well-kept site with a clean repository moves fast. An installation grown over years, with a tag manager, three editors and nobody left who knows why a given script is there, needs archaeology first.
Forms and system connections – A contact form into your own inbox is trivial. Connections to CRM, newsletter, applicant tracking or booking systems each need their own review, often their own agreement, and sometimes a different vendor.
Languages and jurisdictions – Several language versions mean several consent texts, several privacy notices and occasionally several supervisory authorities. The technical overhead is modest; the editorial overhead is not.
Depth of evidence – A working implementation is one thing. An implementation with a documented before-and-after comparison, a recipient list and completed Article 30 input is more work – and the reason some clients call us specifically.

08 — AI stack

Editing your website by chat – and what that means for privacy.

We do not only build with Astro; we put a modern AI stack on top. Concretely: you change your website from a chat – a Telegram bot, for instance. Fix a sentence, add a post, swap an image, correct a price. As a message, not as a CMS session. It belongs on this page because it keeps the number of people with full access to an editing system small – and because it is itself a processing activity that belongs in your records.

Why this fits Astro technically – Astro content lives in a typed, schema-validated content model: content collections with a Zod schema that defines which fields exist and what counts as valid. An agent can write into it in a structured way because the schema is the guard rail. Alternatively the content lives in a headless CMS with an API – equally addressable by machine.
Mistakes fail in the build, not in production – An edit that violates the schema makes the build fail. The live site stays the site that was there before. For privacy purposes the point is this: there is no state in which a half-finished change is live and nobody notices.
Every change is a commit – Who changed what and when is answered by version history rather than by memory. Changes are reviewable and revertable. That is also why, for every embedded third-party domain, the date it was added can be established.
Works for enterprises and sole traders alike – An editorial team with approval stages can use it, and so can a tradesperson who will never open a CMS. Anyone who can send a voice message can maintain their website. That we run chat agents in day-to-day work is evidenced by our own WhatsApp AI agent.
Limit: the messenger is itself a processing activity – The chat path runs through a messenger and a language model. Both are recipients, both belong in the inventory, and depending on the provider both can create third-country exposure. We build it openly and lay out the chain – and if your legal frame does not support it, you stay with the CMS or the repository. Editorial content is rarely personal data in the first place; free-text fields from customer enquiries very much are, and those do not belong in a chatbot.
Limit: the agent decides nothing – Editorial responsibility stays with you – an agent proposes and writes, it does not decide. Large editorial teams with multi-stage approvals still need an editorial system; the chat path complements it. Structural changes such as new page types, layout or navigation remain development work. Which fields and which approval level the agent gets is defined per project. In depth: edit your website by chat.

Evidence, not assertion

We run a WhatsApp AI agent ourselves. That is our reference for this building block – we do not yet have a public Astro client reference, and we are not going to invent one.

Scope gets defined

Which collections, which fields, which approval level: fixed in the project before the first bot reply goes out.

The alternative stays open

If the chat path does not survive the privacy review, the project is not broken. You maintain the site through content collections or a CMS instead.

09 — Honest limits

When we are the right call – and when we are not.

We are developers. We are not lawyers and not an outsourced data protection function. These two columns are the filter we apply in the first call. When the right-hand one wins, we say so and point you elsewhere.

Call us when …

There is a requirement – or a wish to have one – and somebody has to implement it technically and then prove it.

You want to know what your site actually loads before anyone starts assessing anything.
Your data protection officer has written requirements and there is nobody to translate them into code and evidence.
You are planning a new site and would rather settle the privacy questions in the architecture than three weeks before launch.
You want to retrofit an existing site: fonts, embeds, consent enforcement, form paths, measurement.
You want to control hosting and the build chain yourself, including who can read logs and backups.
You need defensible Article 30 input based on measurements rather than on a list of installed tools.

Call somebody else when …

These are things we do not do. Better said now than in the invoice meeting.

You need a legal assessment or a compliance sign-off. We do not give one – that belongs to your law firm or your data protection officer.
You want a privacy notice or consent wording written. We wire it in and link it correctly, but we do not draft it.
You are looking for an outsourced data protection officer or want a data protection impact assessment carried out.
You expect a certificate. There is no meaningful seal that says “GDPR-compliant” for a website, and we do not issue one.
The goal is to keep the tracking and just make it less visible. We will not help with that – not out of principle, but because it increases your risk, not ours.
What you are building is a logged-in application holding user data. Then a website is the wrong category; talk to us about custom software development or bring in our IT project management.

10 — At a glance

GDPR and your website at a glance.

The short version of this page, for whoever has to summarise it in a meeting. The last row is our opinion, not a description.

Compact overview: privacy-first website delivery with Astro.
Question	Short answer
Which rules apply?	Two assessments. The GDPR for processing personal data. § 25 TDDDG – called TTDSG until May 2024 – for storing information on and reading information from the visitor’s device. For breaches of § 25 (1) sentence 1, § 28 TDDDG provides for fines of up to 300,000 euros.
Does static rendering genuinely help?	Yes, within limits. Fewer runtime calls, no plugin code per request, no extension marketplace inside what is served. The default surface is smaller. It is not a legal position.
Where do the real problems sit?	Fonts from a third-party CDN, maps, video, analytics, chat widgets, tag managers. All of them project decisions – and therefore all of them changeable.
When must consent take effect?	Before information is stored on or read from the device. In their guidance for providers of digital services (November 2024), the German supervisory authorities require that refusing consent is clearly recognisable as an equivalent alternative to giving it.
Do we have to host in the EU?	The GDPR does not mandate an EU server location. It requires a Chapter V basis for third-country transfers. Conversely, an EU data centre does not make the question moot when access from a third country is possible.
What do cookieless or server-side analytics change?	They move the question, they do not close it. § 25 TDDDG attaches to access to the device; the GDPR attaches to whether the data relates to a person. Each has to be assessed separately – by your legal advisers.
What do we deliver as evidence?	Request inventory before and after consent, recipient list, third-country exposure, storage locations and retention periods, technical measures – as input for your Article 30 GDPR record.
How long does it take?	Inventory 1–2 weeks. Retrofit of an existing site 2–5 weeks. New build with Astro: 4–10 weeks. The range is moved by the number of third parties, system connections, language versions and review loops.
Our take	Static delivery is the best starting point we know – and it resolves not one of the six places where things actually go wrong. Treat privacy as an architecture question and you end up with less to explain, fewer agreements to sign and a shorter list in your records. Treat it as a banner question and you buy a tool and keep the problem. And we will keep saying it: we build and we evidence, we do not assess. If somebody sells you a GDPR guarantee for a website, read the contract twice.

11 — FAQ

Frequently asked questions about GDPR, TDDDG and websites.

These answers are technical observations from project work and explicitly not legal advice. Assessing your specific case belongs to your data protection officer or your law firm.

Our data protection officer questions every tool we add. What can you hand them?

A measurement instead of a claim. We load your site in a fresh browser profile and log every outbound request, every cookie and every local storage entry – once without consent, once after accepting, once after rejecting. That becomes a table of domain, trigger, data transmitted and recipient. Most data protection officers can work with it immediately, because for the first time they are looking at what actually happens rather than at a list of installed plugins.

We already bought a consent tool. Why do you say it is not blocking?

Because the tool and how it was wired in are two different things. Many consent platforms can block, but are installed in a way that leaves the third-party scripts hard-coded in the document head, where they fire the moment the page loads. The dialog then appears in parallel or afterwards. Testing it takes five minutes: open the page in a private window, click nothing, look at the network list. If a third-party domain is there, the tool did not take effect – whatever the invoice says.

We received a demand letter about Google Fonts. Is that a real risk?

There is a well-known German decision on it: the Regional Court of Munich I ruled on 20 January 2022 (case 3 O 17493/20) that dynamic embedding without consent justified an injunction and 100 euros in damages, because the IP address was transmitted to the provider. That is a first-instance judgment in a single case, not settled higher-court law. How you rate the risk is for your legal advisers. Technically the fix is trivial: put the font files in the project and serve them from your own domain.

We do not want to give up our analytics. Is that even possible any more?

We do not claim that any particular tool is permitted or forbidden – that is a legal assessment. What we do is lay out the options. Consent-gated analytics with proper blocking in front of it. Self-hosted analytics on your infrastructure. Server-side measurement. Or plain log file analysis. For each we state what it costs you in insight, which agreements it requires, and whether it creates third-country exposure. You take the decision with your data protection officer, and we build it.

Does a static website mean we do not need a cookie banner?

No. Whether consent is required depends not on the rendering mode but on whether information is stored on or read from the visitor’s device, and for what purpose. A statically served site with no third parties, no analytics and no marketing cookies does in practice need far less than a grown installation. But that is a consequence of what is embedded, not of how it is rendered. What applies in your case is for your legal advisers to say once the inventory is done.

Marketing needs the tag manager. Can we keep it?

Technically yes, and we wire it in properly: loaded only after consent, with cleanly separated categories. What you should know: a tag manager moves control over which scripts run out of the repository and into an interface that people publish from without developer involvement. Your privacy documentation then goes stale quietly. So on tag manager projects we set up a recurring check that reports when a new domain shows up in what is served.

Do we have to host in the EU?

The GDPR contains no obligation to host in the EU. It requires a basis under Chapter V for transfers to third countries – an adequacy decision or standard contractual clauses, for example. Conversely, a data centre in Frankfurt does not settle the question automatically if support arrangements or group structures allow access from a third country. Because Astro is MIT-licensed and produces static HTML, you stay free to choose: hosting can be moved without a rebuild.

We need a map and videos. Do those have to go?

No, only the moment they load changes. Instead of an iframe that opens a connection to the provider as the page renders, you get a preview served from your own domain – a still image with the address and a directions link for the map, a thumbnail with a play button for the video. The click plus consent triggers the actual load. For visitors the difference is one click. For your documentation it is the difference between “always loads” and “loads on request”.

What happens to the data from our contact form?

That is exactly the question we start with – and surprisingly often nobody can answer it. We map the path: which fields are collected, over which transport they travel, who receives them, where they are stored, who has access, and when they are deleted. Then we shorten the path as far as possible: your domain, your inbox, your system. Every intermediary that remains needs a processor agreement under Article 28 GDPR and an entry in your records.

If something turns out to be wrong, who is liable – you or us?

The controller under the GDPR is normally the website operator, which is you. We are a service provider, liable for our work: that what was agreed got implemented, and that our measurements are accurate. So you get evidence from us rather than assurances. As an aside, the Higher Regional Court of Frankfurt am Main held on 11 December 2025 (case 6 U 81/23) that a third-party vendor can be liable in its own right when its technology accesses devices without consent. Responsibility can exist several times over.

We are a team of 30. Do we really need a record of processing activities?

Article 30 GDPR has relief for organisations under 250 employees, but it only applies where the processing poses no risk to data subjects, is occasional and involves no special categories of data. A permanently running website with a contact form is not occasional processing. In practice small companies therefore keep a record too. Whether you need one is for your legal advisers; the website part is the part we fill in.

We run WordPress with forty plugins. Is switching worth it for privacy reasons?

Sometimes, but rarely on privacy grounds alone. The honest intermediate step is cheaper: remove what nobody needs, enforce consent properly, localise fonts and embeds. If half a dozen extensions still open their own connections afterwards and nobody can say why, a move becomes the sensible option – the whole plugin layer disappears along with its data paths. The process, the risks and the cases where we advise against it are on WordPress to Astro.

You suggest editing by chat. Is that not itself a privacy problem?

It is at minimum a processing activity of its own, and we treat it as one. The messenger and the language model are recipients and belong in the inventory; depending on the provider there is third-country exposure. In favour: editorial content is usually not personal data, and the number of people holding full access to an editing system stays small. Against: your legal frame may not support the path. Then you stay with content collections or a CMS, and the project works just as well.

How long does this take, and what drives the price?

Inventory with a written report: one to two weeks. Retrofitting an existing site: two to five weeks. A new build with Astro that plans for all of it: four to ten weeks. The range is moved by the number of third parties, the system connections behind your forms, the number of language versions, the condition of what exists, and how many review loops with counsel, privacy and marketing are involved. We give a number after the first call – and with the assumptions it rests on.

Is a static website automatically GDPR-compliant?

No. Static rendering reduces the number of places where anything can happen at runtime and removes plugin code from what is served. Whether personal data is processed still depends solely on what is embedded, and how.

Does every website need a cookie banner?

Not every one. § 25 (1) TDDDG requires consent for storing information on and reading information from the device; paragraph 2 contains narrowly drawn exceptions. Whether your case falls under them is a legal assessment, not a question about the framework.

What is the difference between the GDPR and the TDDDG?

The GDPR governs the processing of personal data across the EU. The TDDDG – called TTDSG until May 2024 – is German law and protects terminal equipment in § 25: storing and reading information on the device, regardless of where the data travels afterwards.

Are self-hosted fonts unproblematic from a privacy perspective?

They at least avoid the point the known cases turned on: no request, and therefore no IP address, goes to a third-party provider. Whether that answers everything is for your legal advisers. Check the font licence as well – not every licence permits self-hosting.

Is the EU-US adequacy decision still in force?

Yes. The European Commission adopted it on 10 July 2023, the General Court of the European Union dismissed an action for annulment on 3 September 2025, and the appeal against that judgment is pending before the Court of Justice. It only covers transfers to US companies that have self-certified.

What is a record of processing activities?

The overview required by Article 30 GDPR of which personal data you process for which purpose, who receives it, where it is stored and when it is deleted. For the website portion we supply the input, based on measured requests.

Does a consent banner replace the privacy notice?

No, those are two separate obligations. The banner collects consent for access to the device; the privacy notice satisfies the GDPR information duties. We wire both in correctly – the wording comes from your legal advisers.

12 — Cluster

Related pages in the Astro cluster.

The topics that tend to come up next in a privacy conversation:

13 — Go deeper

GDPR-compliant websites, built with fewer data paths from the start.