This translation has not been editorially reviewed yet. The German version is authoritative. Deutsche Fassung
Data protection
Which US provider contacts my website when viewing the page?
When accessing a website, the browser often loads files from foreign servers: fonts, scripts, videos, cards, counters. Each of these requests transmits the visitor’s IP address to the provider. If the provider is based in the USA, this is a transfer to a third country that needs its own basis – today usually the Data Privacy Framework or standard contractual clauses – and which must be mentioned in the data protection declaration. The data protection check area compares the hosts contacted during the page call with known US providers and identifies them as a list.
Information, not judgment
The finding does not say that the transmission is inadmissible. Many U.S. providers are certified under the Data Privacy Framework, and for others, standard contractual clauses exist; whether this carries in individual cases is a legal question that the audit area does not answer. What he does is the inventory: Which providers are actually contacted before the visitor has clicked anything? Exactly this list must cover the privacy policy – and this list many operators do not know, because fonts, icon libraries and embedments of templates and plugins are brought. The result therefore carries the information level and does not change a point value.
How the assignment arises
The audit area maintains a well-kept list of well-known providers based in the USA — Google with its services, Meta, Microsoft, Cloudflare, Adobe, Amazon infrastructure, Vimeo, Hotjar, HubSpot and more. Every foreign host contacted during the page call is checked against this list. Providers who are not included are not named; the list is deliberately conservative, so that no European provider appears wrongly as a US provider. The test area only sees the hosts, not the contractual situation behind them: A US service via a European contractual partner still appears as a US host because the data flows there.
- Compare the list with your data protection declaration: Each named provider needs an entry there with purpose and basis for transmission.
- Check for each provider whether they are certified under the Data Privacy Framework or have standard contractual clauses.
- Replace what can be replaced: embed fonts and icon libraries locally, load maps and videos only after consent.
- Repeat the check after each plugin or template change — new providers often come in unnoticed.
