GDPR and hotlinked images: are they allowed?

Question

By opening this question, you have automatically sent some data to some random website on the internet, the website hosting the above picture. What data? This is the data that is usually sent:

• Your IP
• A cookie
• The URL you are visiting (the URL of this question)
• Your user-agent (typically including OS version, browser version, etc.)
• The time when you first saw this picture (header: if-modified-since)

This can definitely be personal data according to the GDPR, and in practice in most cases it is.

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

That data is sent somewhere automatically. Did you see any privacy policies? Did you accept anything? No, you don't know how that data will be used. Of course it could be sent to a stupid random website, that will never use it for anything. Or it could be sent to a big corporation, or to a content delivery network, or any website that is big enough to be able to track you with this data, because they have a lot of services (or just hotlinked images) around spread all over the web. Note: the data is actually sent to Imgur, which I believe would definitely be able to track you, given the huge amount of pictures on the internet that link to them.

I've always seen people mainly worried about third-party assets (Google Analytics or Facebook buttons, etc.), some also began to worry about Google Fonts (that's a third-party asset too actually), but I don't think anybody ever brought up the issue of hotlinked images. That's third-party stuff. And communities like this one are basically allowing users to embed third party assets.

Who's responsible for this? Is it the user's fault, because they should always make sure the image source complies with the GDPR? I doubt it. The website owner's fault (Stackexchange), because they should not allow hotlinking? I'd say yeah, probably. Or the third-party website's fault, for not complying with the GDPR? I'd say no, for all we know they could be based in a country that doesn't even know what the GDPR is.

So my conclusion is that hotlinking should be treated like loading a third-party asset, and if the website owner cannot check the privacy policies of every hotlinked image (for example because it would be impossible in a community like this one), then unsupervised hotlinking should be disabled because the GDPR does not allow it. Am I wrong?

Answer 1

You don't need to get consent to comply with GDPR

Lawfulness of processing

1. Processing shall be lawful only if and to the extent that at least one of the following applies:

(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

(c) processing is necessary for compliance with a legal obligation to which the controller is subject;

(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;

(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Sending a http request to a website falls under 6(1)(f).

Answer 2

Potentially allowed, but generally not.

You have correctly analyzed that embedding content/images/scripts/frames/videos will disclose some personal data to the target server. I don't think there is any legal difference between these content types because they all disclose equivalent information to the target server.

If that target server is operated by the same website or one of its data processors, then everything is fine. Data processors are contractually bound to only use the personal data as instructed, but not for their own purposes.

But what if the data is disclosed to an independent third party? Then, the website would need a legal basis for this disclosure.

In many cases, this legal basis will be consent. For example, it is common to replace embedded Youtube videos, maps, or tweets with a placeholder that explains the situation. Users can click to give consent, upon which the embedded content will be loaded. I have discussed this in another answer, in the context of the FashionID judgement.

However, Dale M correctly points out that you might not need consent. For example, you might have a “legitimate interest” for disclosing the data, or it might be necessary for performing or entering into a contract with the data subject.

But it's not quite as easy: loading the third party content must actually be necessary for the legitimate interest or for performing the contract. If you could self-host the content (or engage a data processor to host it on your behalf), then it isn't necessary to load it from a third party server. This also means that using content delivery networks (CDNs) is probably not GDPR-compliant unless the CDN is contractually bound to act as a data processor. For example, there's a German judgement from 2022 saying that loading a webfont from Google Fonts is not necessary for a legitimate interest – because the font could be self-hosted instead.

There are two interesting complications in your particular scenario:

• who is the data controller?
• could the content be self-hosted instead?

The data controller is responsible for compliance. On a site with user-generated content, the site operator will be a controller because they determine how the site works. But a user on that platform might be a joint controller for some aspects (e.g. see CJEU case C210/16 “Wirtschaftsakademie Schleswig-Holstein” about the joint controllership regarding Facebook fan pages). If the site makes it possible to embed third-party content, then arguably both the platform and the author are jointly responsible for GDPR compliance. The exact responsibilities could be divided according to the platform's terms of service. The platform could prevent disclosure of visitor personal data to third parties by caching the content on their own servers.

But this might run into the problem: the embedded content will generally be copyrighted material, and the website/platform would not have any license to make a copy of the third-party content. In such a scenario, it may be impossible to self-host the content, making it actually necessary to hotlink the content. Thus, there could be a colorable argument that copyright law could make hotlinking necessary in the sense of Art 6(1)(f).

I personally wouldn't make that argument, because loading the embedded content is not necessary to display the page – instead, a consent interstitial could be used, as is common for embedded Youtube videos, maps, and tweets.

PS: your question might not involve a hotlinked image in the sense of this answer. The i.stack.imgur.com domain is provided by Imgur on behalf of Stack Overflow, though I'm not sure if Imgur is indeed acting as a data processor because they're not listed on the Stack Overflow subprocessor page.

Answer 3

This is a GDPR violation if the user's browser is not set to reject 3rd party cookies, and the third party site does. I checked and imgur does not appear to use cookies just for requesting that image. However, they may log an IP address, which is covered as personally identifying data.

Assuming that data is collected, then Stack Exchange should stop using the third party site to be compliant. The third party site should stop allowing off-site display of images this way, and first send a response containing a permission request.

If no data is collected, there is no problem. I had a look at imgur's response to the HTTPS request, and it does not use cookies. They may still log other data and would need to carefully anonymise it to be complaint. Hopefully SE checked that they do.