2

image of jim carrey

By opening this question, you have automatically sent some data to some random website on the internet, the website hosting the above picture. What data? This is the data that is usually sent:

  • Your IP
  • A cookie
  • The URL you are visiting (the URL of this question)
  • Your user-agent (typically including OS version, browser version, etc.)
  • The time when you first saw this picture (header: if-modified-since)

This can definitely be personal data according to the GDPR, and in practice in most cases it is.

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

That data is sent somewhere automatically. Did you see any privacy policies? Did you accept anything? No, you don't know how that data will be used. Of course it could be sent to a stupid random website, that will never use it for anything. Or it could be sent to a big corporation, or to a content delivery network, or any website that is big enough to be able to track you with this data, because they have a lot of services (or just hotlinked images) around spread all over the web. Note: the data is actually sent to Imgur, which I believe would definitely be able to track you, given the huge amount of pictures on the internet that link to them.

I've always seen people mainly worried about third-party assets (Google Analytics or Facebook buttons, etc.), some also began to worry about Google Fonts (that's a third-party asset too actually), but I don't think anybody ever brought up the issue of hotlinked images. That's third-party stuff. And communities like this one are basically allowing users to embed third party assets.

Who's responsible for this? Is it the user's fault, because they should always make sure the image source complies with the GDPR? I doubt it. The website owner's fault (Stackexchange), because they should not allow hotlinking? I'd say yeah, probably. Or the third-party website's fault, for not complying with the GDPR? I'd say no, for all we know they could be based in a country that doesn't even know what the GDPR is.

So my conclusion is that hotlinking should be treated like loading a third-party asset, and if the website owner cannot check the privacy policies of every hotlinked image (for example because it would be impossible in a community like this one), then unsupervised hotlinking should be disabled because the GDPR does not allow it. Am I wrong?

  • If the five pieces of data are the only data the third-party processes, are they sufficient alone or together for the third-party to identify a person? – Lag Sep 9 '18 at 7:49
  • @Lag, I don't think that to "identify" a person you necessarily need their first and last name, according to the GDPR. You only need to be potentially identifiable, even by means of a unique cookie for example. That's the way I understand it. A hotlinked image can potentially act exactly the same as a "web beacon / tracking pixel", and I think the GDPR definitely applies to such behavior. – reed Sep 9 '18 at 13:06
1

You don't need to get consent to comply with GDPR

Lawfulness of processing

  1. Processing shall be lawful only if and to the extent that at least one of the following applies:

(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

(c) processing is necessary for compliance with a legal obligation to which the controller is subject;

(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;

(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Sending a http request to a website falls under 6(1)(f).

  • 1
    This can't be true in general. Everything on the web is based on just sending HTTP requests, even tracking pixels or Google Analytics itself. If HTTP requests didn't require consent in general, then nothing on the web would require consent. Anyway, what makes the above image different from a web beacon (tracking pixel)? How can you make sure nothing is being tracked, if nobody reads the privacy policy of the image hosting provider? – reed Sep 10 '18 at 9:29
  • The cynical position is that effectively the entire internet has been criminalized, but that it's left completely to EU discretion whom to fine or prosecute. – kbelder May 21 at 16:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.