Referenz
Web-Datenschutz-Glossar
Klare Definitionen für Begriffe, die bei Datenschutzaudits, regulatorischen Einreichungen, Verkaufsgesprächen und Rechtsstreitigkeiten auftauchen.
- A/B Testing
A technique that serves two or more page variants to different visitor segments to compare performance. A/B testing tools typically load JavaScript on the page and may fire analytics or conversion tags in each branch.
Warum es wichtig ist
Each variant can trigger different sets of tags and pixels, meaning data may flow to third parties in ways that differ from the documented tag inventory. Consent signals must propagate correctly into every branch, and both variants must behave the same way with regard to which cookies and beacons fire.
Auch bekannt als: Split testing, Multivariate testing
- Adequacy decision
A formal ruling by the European Commission that a country outside the European Economic Area provides an essentially equivalent level of data protection to the GDPR. Transfers to an adequate country may proceed without additional safeguards such as Standard Contractual Clauses.
Warum es wichtig ist
Adequacy decisions can be revoked or suspended. Organizations that rely on an adequacy ruling for transfers to a third country without a fallback mechanism may find themselves in violation overnight, including for data sent by marketing pixels and analytics beacons that silently route to servers in that country.
Auch bekannt als: Adequacy ruling
- Bid request
A message sent from a supply-side platform to ad exchanges and demand-side platforms when a web page loads, containing data about the visitor and the ad slot. Bid requests commonly include IP address, browser fingerprint attributes, inferred location, and contextual signals.
Warum es wichtig ist
Bid request transmission is a form of data sharing. Where the page visitor has not provided consent, or has exercised a right to opt out of sale or sharing, sending that visitor profile into a real-time bidding auction may conflict with CCPA, CPRA, GDPR, and similar regulations. The transmissions occur in milliseconds and are invisible without network-level monitoring.
Auch bekannt als: RTB bid request, Programmatic bid request
- Breach notification
The legal obligation to report unauthorized access to, or disclosure of, personal data within prescribed time windows to regulators and, in many cases, to affected individuals. Deadlines vary by jurisdiction: 72 hours under GDPR, 30 days under many US state laws.
Warum es wichtig ist
A breach that originates in a third-party tag or an exfiltrated form field still triggers the controller's notification obligation. Knowing which third parties receive data from a site, and what that data contains, is prerequisite to scoping and responding to a breach within the required window.
- Browser fingerprinting
A technique that identifies or re-identifies a device or browser without cookies, by combining attributes such as screen resolution, installed fonts, WebGL rendering output, audio context, time zone, and HTTP headers into a probabilistic identifier.
Warum es wichtig ist
Fingerprinting bypasses consent controls that govern cookies, because no data is stored in the browser. Regulators in the EU explicitly classify fingerprinting as a tracking technology subject to ePrivacy rules. Sites that prohibit tracking cookies but load fingerprinting scripts may be compliant on paper and non-compliant in practice.
Auch bekannt als: Device fingerprinting, Canvas fingerprinting
- CCPA
The California Consumer Privacy Act, effective January 2020, gives California residents rights over personal information held by covered businesses, including the right to know, the right to delete, and the right to opt out of the sale of their personal information.
Warum es wichtig ist
CCPA applies to businesses meeting revenue or data-volume thresholds and has no private right of action for most violations, but its statutory damages provision for data breaches and enforcement by the California Attorney General create real financial exposure. Third-party tags that share visitor data without a sale opt-out mechanism are a common and documented source of violations.
Auch bekannt als: California Consumer Privacy Act
- CMP
A Consent Management Platform is software that presents a privacy notice, collects and stores user consent preferences, and communicates those preferences to downstream tags and services. CMPs are commonly displayed as cookie banners.
Warum es wichtig ist
A CMP that is misconfigured, outdated, or not tested regularly may accept or reject consent and then fail to propagate that signal to every tag. The result is tags firing in violation of the stated policy. CMP configuration drift is one of the most common root causes of technically documented non-compliance.
Auch bekannt als: Consent management platform
- CNAME cloaking
A technique in which a first-party subdomain (for example, metrics.example.com) is mapped via a DNS CNAME record to a third-party analytics or advertising domain. Browsers treat requests to that subdomain as first-party, bypassing tracking protections that target known third-party hostnames.
Warum es wichtig ist
CNAME cloaking is used specifically to circumvent browser-based and network-based content blocking. Regulatory guidance from the CNIL and others has indicated that CNAME-based tracking still requires consent where the data is ultimately controlled by a third party. Detecting it requires DNS resolution or network-layer inspection, not just page scanning.
Auch bekannt als: CNAME tracking
- Cohort-based advertising
A targeting approach where users are grouped into interest cohorts based on browsing behavior, and ads are served based on cohort membership rather than individual tracking. Google's Privacy Sandbox Topics API is an example of this model.
Warum es wichtig ist
Cohort systems are designed to limit cross-site individual tracking, but they still process browsing history on-device and expose cohort membership to publishers and ad buyers. Regulators have scrutinized whether cohort assignment itself constitutes personal data processing requiring consent.
Auch bekannt als: Interest-based advertising, Topics API
- Colorado CPA
The Colorado Privacy Act, effective July 2023, grants Colorado residents rights including access, correction, deletion, portability, and opt-out of targeted advertising, sale, and profiling. It applies to controllers meeting data-volume thresholds.
Warum es wichtig ist
The Colorado CPA shares structural similarities with Virginia CDPA and CPRA but has its own thresholds and cure provisions. Organizations managing multi-state privacy programs must track these differences, and websites with retargeting or analytics tags may need to honor Colorado opt-out signals.
Auch bekannt als: CPA, Colorado Privacy Act
- Consent string
A compact, encoded data structure (commonly IAB TCF format) that records a user's consent and legitimate interest preferences across vendors and purposes. Consent strings are stored in cookies and passed between CMPs, publishers, and advertising technology systems.
Warum es wichtig ist
A consent string that does not accurately reflect what the user selected, or that is shared with vendors not disclosed at the time of consent, can invalidate the consent. Auditing whether the string transmitted in bid requests matches the user's actual choice is technically possible but rarely done without dedicated tooling.
Auch bekannt als: TCF consent string, IAB consent string
- Content Security Policy
An HTTP response header that instructs browsers which sources are permitted to load scripts, images, frames, and other resources on a page. A strict CSP can prevent injected or unauthorized third-party code from executing.
Warum es wichtig ist
A permissive or absent CSP means any script introduced via a tag manager, supply chain compromise, or ad injection can call out to any external server. CSP is a first line of defense against unauthorized data exfiltration and is reviewed in security audits and some privacy assessments.
- CPPA
The California Privacy Protection Agency is the dedicated state agency responsible for implementing and enforcing California's privacy laws, including the CPRA. It has independent rulemaking authority and investigative powers.
Warum es wichtig ist
Unlike enforcement solely by the Attorney General, the CPPA can initiate investigations without a complaint and issue regulations that expand or clarify obligations. Businesses should monitor CPPA rulemaking for changes to opt-out requirements, risk assessment obligations, and automated decision-making rules.
- CPRA
The California Privacy Rights Act, which amended and expanded the CCPA effective January 2023, adding rights over sensitive personal information, requiring purpose limitation, establishing data minimization obligations, and creating the CPPA.
Warum es wichtig ist
CPRA introduced the concept of "sharing" personal information for cross-context behavioral advertising as a separate opt-out right from "sale." Many advertising and analytics tag arrangements that were borderline under CCPA are more clearly regulated under CPRA's sharing definition. Failing to honor the opt-out of sharing can expose a business to both enforcement and litigation.
Auch bekannt als: California Privacy Rights Act, CCPA amended
- Cross-site tracking
The practice of following a user's behavior across multiple unrelated websites, typically via third-party cookies, pixels, fingerprinting, or identity graphs, to build a profile used for advertising or analytics.
Warum es wichtig ist
Cross-site tracking is the central behavior that most privacy regulations target. Browser vendors have progressively restricted third-party cookies, but tracking continues via alternative mechanisms including fingerprinting and first-party data partnerships. Demonstrating that cross-site tracking is blocked or consented requires network-level evidence.
- Dark patterns
Interface design choices that manipulate users into actions they did not intend or would not choose with full information. In a privacy context, dark patterns appear in consent flows, cookie banners, and account settings to discourage users from exercising privacy rights.
Warum es wichtig ist
Regulators including the CNIL, ICO, and FTC have issued guidance and enforcement decisions specifically targeting dark-pattern consent flows. A consent obtained through a dark pattern may be legally invalid, meaning all data collected under it lacks a lawful basis. The risk is highest in banner designs where "reject all" is hidden or requires more steps than "accept all."
- Data broker
A company that collects personal information from various sources and sells, licenses, or shares it with other organizations. Data brokers aggregate records from public filings, commercial databases, website activity, and other sources.
Warum es wichtig ist
Data broker beacons and pixels appearing on a company's website can constitute a sale or sharing of personal information under CCPA and CPRA even if the company has no direct commercial relationship with the broker. Detecting data broker requests requires examining outbound network calls, not just reviewing vendor contracts.
- Data controller
Under GDPR and UK GDPR, the natural or legal person that determines the purposes and means of processing personal data. A company that decides why and how it collects visitor data on its website is typically the data controller.
Warum es wichtig ist
Controllers bear primary legal responsibility for compliance, including ensuring that processors act only on their instructions, that lawful bases are documented, and that data subject rights are honored. Third-party tags deployed by a controller on its own website may involve joint controllership if the third party also determines processing purposes.
Auch bekannt als: Controller
- Data Processing Agreement
A contract required by GDPR Article 28 between a data controller and a data processor, specifying the subject matter, duration, nature, and purpose of processing, as well as the obligations and rights of each party.
Warum es wichtig ist
If a third-party tag is sending personal data to a vendor and no DPA is in place, the transfer lacks a lawful contractual basis under GDPR. Many marketing and analytics vendors offer standard DPAs, but they must be signed, kept current, and matched to the actual data flows on the site.
Auch bekannt als: DPA (processing agreement), Data processor agreement
- Data processor
Under GDPR and UK GDPR, an entity that processes personal data on behalf of and under the instruction of a data controller. Analytics vendors, CRM systems, and cloud hosting providers often act as processors.
Warum es wichtig ist
Controllers must have a written data processing agreement in place with each processor. If a tag on the website is sending data to a vendor that processes it beyond what the DPA permits, both parties may be exposed. Knowing which vendors receive data from a site is a prerequisite to maintaining compliant DPAs.
Auch bekannt als: Processor, Sub-processor
- Data Subject Request
A formal request by an individual exercising their rights under data protection law, such as the right to access, correct, delete, or port their personal data, or to object to processing.
Warum es wichtig ist
DSRs must be fulfilled within prescribed timeframes (one month under GDPR; 45 days under CCPA). Completing a deletion request requires knowing every system and vendor that holds the individual's data, including analytics platforms and advertising networks that received data via the company's website tags.
Auch bekannt als: DSR, DSAR, Data subject access request, Right of access request
- DPIA
A Data Protection Impact Assessment is a structured process required by GDPR Article 35 before undertaking processing that is likely to result in high risk to individuals. DPIAs identify risks and document the measures taken to address them.
Warum es wichtig ist
Activities commonly requiring a DPIA include systematic monitoring of publicly accessible areas, large-scale processing of special category data, and profiling. Deploying certain advertising or analytics technologies on a website at scale, or integrating data sources, may trigger the DPIA obligation. Proceeding without one when required is a GDPR violation independent of whether harm results.
Auch bekannt als: Data Protection Impact Assessment
- ePrivacy Directive
EU Directive 2002/58/EC (amended by 2009/136/EC), which governs electronic communications privacy in the EU and EEA. It requires prior informed consent before storing or accessing information on a user's device, including cookies and fingerprinting, with narrow exceptions for technically necessary storage.
Warum es wichtig ist
The ePrivacy Directive is the legal basis for cookie consent requirements across the EU, not GDPR. Many enforcement cases for cookie violations are brought under national implementations of this directive. Its replacement (the ePrivacy Regulation) remains pending, meaning the current rules continue to apply.
Auch bekannt als: Cookie Directive, ePD
- GDPR
The General Data Protection Regulation (EU 2016/679) is the EU's primary data protection law, applying to the processing of personal data by organizations established in the EU/EEA, and to organizations outside the EU that target EU residents or monitor their behavior.
Warum es wichtig ist
GDPR fines can reach 4% of global annual turnover or 20 million euros, whichever is higher. Website operators are controllers responsible for every tag and pixel they load, including those from third-party vendors. Documented enforcement covers cookies, analytics without consent, and cross-border transfers without adequate safeguards.
Auch bekannt als: General Data Protection Regulation
- GPC
Global Privacy Control is a browser-based signal that communicates a user's preference to opt out of the sale and sharing of personal information. It is transmitted as an HTTP header (Sec-GPC: 1) and a JavaScript property.
Warum es wichtig ist
CPRA requires covered businesses to honor GPC as a valid opt-out of sale and sharing. California enforcement has included GPC non-compliance as part of investigations. Detecting whether a site actually changes its tag behavior in response to a GPC signal requires active testing, not just policy review.
Auch bekannt als: Global Privacy Control, Opt-out preference signal
- HIPAA
The Health Insurance Portability and Accountability Act sets federal standards in the United States for protecting individually identifiable health information (Protected Health Information) held or transmitted by covered entities and their business associates.
Warum es wichtig ist
Healthcare organization websites, hospital patient portals, and health-adjacent services that deploy analytics or advertising pixels may be transmitting PHI to third parties without a Business Associate Agreement. Federal regulators have issued guidance and enforcement actions specifically addressing tracking technologies on healthcare websites. This is an active litigation and enforcement area.
Auch bekannt als: Health Insurance Portability and Accountability Act
- HSTS
HTTP Strict Transport Security is an HTTP response header that instructs browsers to connect to the site only over HTTPS for a defined period, preventing protocol downgrade attacks and cookie hijacking over unencrypted connections.
Warum es wichtig ist
A site without HSTS is vulnerable to man-in-the-middle attacks that can intercept session cookies and inject scripts. An injected script can exfiltrate form data or bypass consent controls. HSTS is a baseline security control that directly affects the integrity of the privacy stack deployed on a site.
Auch bekannt als: HTTP Strict Transport Security
- ID sync
A process in programmatic advertising in which two or more ad technology companies match their internal user identifiers to the same real-world browser or device, enabling cross-platform targeting without a shared cookie. ID syncing typically involves pixel-based redirects.
Warum es wichtig ist
ID sync happens silently through redirect chains loaded by ad tags. Each redirect can create a new data-sharing relationship that was not disclosed to the user. The volume and breadth of ID syncing on a page is rarely visible through standard tag audits and requires network-level analysis.
- Just-in-time notice
A privacy disclosure presented to users at the moment data collection is about to occur, rather than in a general privacy policy. Common examples include a tooltip or pop-up shown when a user focuses on a form field that will collect sensitive information.
Warum es wichtig ist
Just-in-time notices are associated with stronger informed consent because they provide context at decision time. Regulators in some jurisdictions look favorably on them for sensitive data collection. For web forms collecting information such as health conditions, insurance details, or financial data, the absence of contextual notice can be a factor in privacy risk assessments.
Auch bekannt als: JIT notice, Contextual privacy notice
- Legitimate interests
A lawful basis under GDPR Article 6(1)(f) that permits processing of personal data when it is necessary for the legitimate interests of the controller or a third party, provided those interests are not overridden by the interests, rights, and freedoms of the data subject.
Warum es wichtig ist
Legitimate interests is the most flexible GDPR lawful basis, but it requires a documented balancing test. Relying on it without that test, or using it for processing a reasonable person would not expect, leaves the organization exposed. Regulators have rejected legitimate interests claims for behavioral advertising and cross-site tracking in numerous decisions.
Auch bekannt als: LI, Legitimate interest assessment
- Local storage
A browser API that allows websites to store key-value data in the user's browser without an expiration date. Unlike cookies, local storage data is not sent automatically with HTTP requests, but it is accessible to scripts running on the same origin.
Warum es wichtig ist
Local storage is used by some analytics and advertising scripts to persist identifiers that survive cookie deletion. Because it behaves differently from cookies, some consent frameworks do not clear local storage on opt-out, creating a residual tracking vector. Auditing local storage requires JavaScript inspection, not HTTP header analysis.
Auch bekannt als: localStorage
- Masking
A data redaction technique in session replay and form analytics tools that replaces sensitive input values (such as passwords, credit card numbers, and personal identifiers) with placeholder characters before the data is captured or transmitted.
Warum es wichtig ist
Session replay tools that do not mask form fields correctly can capture and transmit literal passwords, health details, or financial data to a third-party analytics server. Masking configuration must be validated through active testing rather than relying on vendor defaults, which vary and can regress with tool updates.
- Mixed content
A condition where an HTTPS page loads resources (scripts, images, iframes) over HTTP. Active mixed content (scripts and iframes) is blocked by modern browsers; passive mixed content (images) generates warnings.
Warum es wichtig ist
A third-party script loaded over HTTP on an HTTPS page is both a security risk and typically blocked by browsers, which can break tag functionality silently. From a privacy perspective, HTTP requests for tracking assets may expose referrer information and user data to interception. Mixed content is a signal that the site's tag governance has not been reviewed recently.
- Opt-out of sale
A legally mandated right under CCPA and CPRA allowing California consumers to instruct a business not to sell their personal information to third parties. Covered businesses must display a "Do Not Sell or Share My Personal Information" link.
Warum es wichtig ist
Many advertising technology arrangements qualify as a "sale" of personal information under CCPA's broad definition. A site that loads advertising tags without honoring opt-out requests, or that has a consent mechanism that does not actually stop data from flowing to ad partners, may be in violation regardless of what the privacy policy states.
Auch bekannt als: Do Not Sell, Do Not Sell or Share
- Personal data
Under GDPR, any information relating to an identified or identifiable natural person. This includes obvious identifiers like names and email addresses, and less obvious ones such as IP addresses, cookie identifiers, device fingerprints, and online behavioral profiles.
Warum es wichtig ist
The scope of "personal data" is broader than commonly assumed. An IP address alone has been ruled personal data by European courts. Online identifiers embedded in advertising tags, including cookie IDs and fingerprint hashes, fall within this definition, meaning every tag that transmits them is processing personal data and must have a lawful basis.
Auch bekannt als: Personal information (GDPR sense)
- PHI
Protected Health Information is individually identifiable health information created, received, maintained, or transmitted by a HIPAA-covered entity or business associate. In a web context, it can include information inferred from pages visited, search terms, or form data on healthcare sites.
Warum es wichtig ist
Analytics and advertising pixels on healthcare websites can capture and transmit page URLs containing diagnosis codes, symptom descriptions, or appointment types, constituting unauthorized PHI disclosure. Federal enforcement guidance issued in 2022 and subsequent court decisions have focused specifically on this risk pattern.
Auch bekannt als: Protected Health Information
- PII
Personally Identifiable Information is a term used primarily in US law and policy contexts to describe information that can be used on its own or combined with other data to identify a specific individual. Definitions vary by statute and context.
Warum es wichtig ist
Unlike GDPR's "personal data," PII lacks a single authoritative definition across US federal and state laws. This ambiguity creates risk: an organization that manages PII narrowly (names, Social Security numbers) may overlook that IP addresses, behavioral profiles, or inferred characteristics qualify as personal information under CCPA or personal data under GDPR.
Auch bekannt als: Personally identifiable information, Personal information (US context)
- Privacy policy
A public-facing document that describes how an organization collects, uses, stores, shares, and protects personal data. Privacy policies are required by GDPR, CCPA, and most other major privacy laws.
Warum es wichtig ist
A privacy policy that does not accurately reflect actual data flows on the site creates legal exposure. If tags and beacons send data to vendors not disclosed in the policy, or if the retention periods stated are not honored, the policy becomes a liability rather than a protection. Policies must be kept in sync with the live technology inventory.
- Real-time bidding
An automated programmatic advertising mechanism in which ad impressions are auctioned in the milliseconds between a page request and render. Visitor data is broadcast to multiple potential buyers via bid requests.
Warum es wichtig ist
RTB involves broadcasting personal data to hundreds of potential buyers per page load, the vast majority of whom will not win the auction and receive no compensation for the exposure. European DPAs and the IAB's TCF have faced sustained regulatory challenge over whether RTB at scale can be made compatible with GDPR's data minimization and purpose limitation requirements.
Auch bekannt als: RTB, Programmatic advertising
- Record of Processing Activities
A documented inventory required by GDPR Article 30 for controllers and processors, listing processing activities, their purposes, categories of data and data subjects, recipients, transfers, and retention periods.
Warum es wichtig ist
The ROPA must reflect actual processing, not just intended processing. If the live website loads tags that transmit data to vendors not in the ROPA, the document is inaccurate and the organization is operating without required accountability documentation. Maintaining an accurate ROPA requires an up-to-date view of every vendor and data flow active on the site.
Auch bekannt als: ROPA, Article 30 record
- Referrer leakage
The transmission of the HTTP Referer header or document.referrer value to third parties when a user navigates from one page to another. The referrer URL can expose sensitive information such as search queries, page names containing health conditions, or account identifiers.
Warum es wichtig ist
Referrer leakage is a common and underappreciated data exposure. A user on a health symptom page who clicks to a resource may send the full URL of the symptom page to the destination and to any third-party scripts loaded there. Setting Referrer-Policy headers controls this at the server level, but individual links can also be hardened with rel="noreferrer".
- Referrer-Policy
An HTTP response header that controls how much referrer information is included in requests made from the page. Options range from no-referrer (nothing sent) to unsafe-url (full URL always sent), with strict-origin-when-cross-origin as a commonly recommended default.
Warum es wichtig ist
Without an explicit Referrer-Policy, browsers apply their own defaults and may send full URLs including query strings and path segments to every third-party resource loaded on the page. A permissive or absent policy is a routine finding in privacy audits and contributes to referrer leakage exposures.
Auch bekannt als: Referrer policy header
- Right to erasure
A data subject right under GDPR Article 17 allowing individuals to request deletion of their personal data in certain circumstances, such as when the data is no longer necessary for its original purpose or consent has been withdrawn.
Warum es wichtig ist
Fulfilling erasure requests requires knowing every system and vendor that holds data about the individual, including advertising platforms that received identifiers via website tags. Incomplete vendor inventory is the most common reason organizations cannot confirm erasure within the required timeframe.
Auch bekannt als: Right to be forgotten, Erasure request
- ROPA
See: Record of Processing Activities.
Warum es wichtig ist
See the Record of Processing Activities entry for full detail on why an accurate ROPA is essential for GDPR accountability.
Auch bekannt als: Record of Processing Activities
Siehe auch:Record of Processing Activities
- Sale of personal information
Under CCPA, selling means providing personal information to a third party for monetary or other valuable consideration. The definition is broad and has been interpreted to include making data available to ad networks in exchange for ad services.
Warum es wichtig ist
Many website operators do not recognize that loading standard advertising scripts constitutes a "sale" under CCPA. Enforcement actions and class actions have targeted this gap. Honoring opt-out rights requires that the tag stack actually changes behavior when a user opts out, which must be verified through testing.
Auch bekannt als: CCPA sale, Sale of PI
- SameSite
A cookie attribute that controls whether a cookie is sent with cross-site requests. Values are Strict (same-site only), Lax (same-site plus top-level navigations), and None (all contexts, requires Secure flag).
Warum es wichtig ist
Cookies without a SameSite attribute are treated as Lax by modern browsers by default, reducing cross-site transmission. Third-party cookies that require cross-site access must use SameSite=None; Secure. As third-party cookies are phased out, SameSite configuration becomes important for session integrity and CSRF protection on first-party cookies.
Auch bekannt als: SameSite cookie attribute
- Sensitive personal information
A category of personal data that receives heightened protection under CPRA and similar laws. Under CPRA, it includes Social Security numbers, financial account information, health data, racial or ethnic origin, biometric data, and geolocation.
Warum es wichtig ist
CPRA gives consumers the right to limit the use and disclosure of sensitive personal information. Websites that infer health conditions, location, or ethnic origin from behavioral data or page-visit patterns, and share that with third parties via tags, may be handling sensitive personal information without the required disclosures and opt-out mechanisms.
- Session replay
A category of analytics tool that records user interactions on a webpage (mouse movements, clicks, keystrokes, scroll depth) and allows operators to play back a reconstruction of the session. Common vendors include Hotjar, FullStory, and Microsoft Clarity.
Warum es wichtig ist
Session replay can capture sensitive form inputs, including passwords and health information, if masking is not configured correctly. Multiple wiretapping and CIPA lawsuits have been filed against operators of websites that recorded sessions without adequate notice or consent. The data is transmitted to a third party by definition.
Auch bekannt als: Session recording, Session recording tool
- Standard Contractual Clauses
Pre-approved contract clauses issued by the European Commission that provide a legal mechanism for transferring personal data from the EU/EEA to third countries that do not have an adequacy decision. Updated in 2021 to reflect GDPR.
Warum es wichtig ist
Organizations that rely on SCCs for data transfers must also conduct a Transfer Impact Assessment to verify the destination country's laws do not undermine the protections in the clauses. Transfers to the US using SCCs were the subject of intense regulatory scrutiny following the Schrems II ruling.
Auch bekannt als: SCCs, Model clauses, Standard clauses
- Subdomain takeover
A vulnerability where an attacker registers a cloud or SaaS resource (such as a CDN endpoint or code hosting page) that a company's DNS CNAME record still points to, after the original resource was decommissioned.
Warum es wichtig ist
A subdomain takeover allows an attacker to serve content or scripts under a trusted first-party subdomain, bypassing CSP that permits the company's own origin. From a privacy perspective, it is a vector for injecting exfiltration code into a page with the same trust as the organization's own JavaScript.
- Tag manager
A system that allows marketers and analysts to deploy JavaScript snippets (tags) on a website through a user interface without requiring code deployments. Common platforms include Google Tag Manager, Tealium, and Adobe Launch.
Warum es wichtig ist
Tag managers give non-technical staff the ability to add any code to a website. Without governance controls, they are the primary mechanism through which unapproved or misconfigured tracking scripts enter a site. Every tag added through a tag manager is a potential data-sharing relationship that must be reviewed for consent and disclosure compliance.
Auch bekannt als: TMS, Tag management system
- TLS
Transport Layer Security is the cryptographic protocol that provides encrypted communication between a browser and a server, forming the basis of HTTPS. It prevents interception and modification of data in transit.
Warum es wichtig ist
Without TLS, all data transmitted between a user's browser and a server, including form submissions, session tokens, and behavioral data, is readable by anyone on the network. TLS is a baseline requirement in virtually every privacy and security framework. Sites still serving pages or resources over HTTP are failing a fundamental control.
Auch bekannt als: HTTPS, SSL, SSL/TLS
- Tracking pixel
A 1x1 pixel image or invisible element embedded in a web page or email that fires a request to a third-party server when loaded, transmitting data about the visitor including IP address, browser, referrer, and page URL.
Warum es wichtig ist
Pixels are among the most common mechanisms for transmitting visitor data to advertising networks, analytics providers, and data brokers. They are often loaded without the visitor's knowledge and, depending on the data they transmit, may constitute a sale or sharing of personal information under CCPA and CPRA, or processing requiring consent under GDPR.
Auch bekannt als: Web beacon, Pixel, Spy pixel
- Transfer Impact Assessment
An evaluation required alongside Standard Contractual Clauses that assesses whether the legal framework of the destination country undermines the protections the SCCs are intended to provide, particularly regarding government access to transferred data.
Warum es wichtig ist
Following the Schrems II ruling, organizations transferring EU personal data under SCCs must document a TIA. For organizations that use US-based analytics, advertising, or cloud vendors, the TIA must address US surveillance laws. Many organizations have not completed this analysis for their full vendor stack.
Auch bekannt als: TIA
- UK GDPR
The retained version of GDPR incorporated into UK law after Brexit, with modifications by the Data Protection Act 2018. It applies to organizations established in the UK, or that target UK residents.
Warum es wichtig ist
Following Brexit, the UK and EU operate separate but broadly similar data protection regimes. Organizations serving users in both jurisdictions must comply with both. Data flows between the UK and EU are currently covered by a UK adequacy decision from the EU, but this is subject to review.
Auch bekannt als: United Kingdom GDPR
- US state privacy laws
A growing body of state-level consumer privacy legislation in the United States, modeled partly on CCPA and CPRA. States with comprehensive laws include Virginia (CDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and Texas (TDPSA), among others.
Warum es wichtig ist
In the absence of a comprehensive federal privacy law, organizations operating across the US must track an expanding and divergent set of state obligations. Threshold requirements, opt-out rights, and enforcement mechanisms differ by state. Websites with broad US audiences may be subject to multiple state frameworks simultaneously.
Auch bekannt als: State privacy laws, Comprehensive state privacy laws, CDPA, CTDPA
- Vendor / subprocessor
A third-party organization engaged by a data processor to carry out specific processing activities on behalf of the controller. Under GDPR, processors must obtain controller authorization before engaging subprocessors and remain liable for their compliance.
Warum es wichtig ist
Tags and scripts loaded on a website may engage subprocessors that are not disclosed to or approved by the data controller. Each undisclosed subprocessing relationship is a potential GDPR compliance gap. Maintaining an accurate vendor and subprocessor list requires continuous monitoring of which domains and services are actually called by the site.
Auch bekannt als: Subprocessor, Third-party vendor
- Virginia CDPA
The Virginia Consumer Data Protection Act, effective January 2023, grants Virginia residents rights including access, correction, deletion, portability, and opt-out of targeted advertising, sale, and profiling in furtherance of decisions with legal effects.
Warum es wichtig ist
Virginia CDPA has no private right of action but is enforced by the Attorney General. Its opt-out obligations for targeted advertising cover the use of data from multiple contexts for advertising, which includes most behavioral retargeting implementations. Organizations with Virginia website traffic should assess whether their consent and tag infrastructure honors these rights.
Auch bekannt als: CDPA, Virginia Consumer Data Protection Act
- VPPA
The Video Privacy Protection Act is a US federal statute from 1988 that prohibits video service providers from knowingly disclosing personally identifiable information about a consumer's video viewing history without consent.
Warum es wichtig ist
VPPA has been used in a significant volume of class action litigation against websites that embed video players and simultaneously load Meta Pixel, TikTok Pixel, or similar tracking tags. Plaintiffs argue that sending a viewer's identity alongside video watch events constitutes disclosure of video viewing history. This is an active litigation pattern across media, news, and entertainment websites.
Auch bekannt als: Video Privacy Protection Act
- Web analytics
The collection and analysis of data about website visitor behavior, including page views, sessions, traffic sources, and conversions. Common tools include Google Analytics, Adobe Analytics, and privacy-focused alternatives.
Warum es wichtig ist
Standard web analytics implementations transfer visitor behavioral data to third-party servers, which may constitute processing requiring consent under GDPR and ePrivacy rules. European DPAs including the Austrian, French, Italian, and Danish authorities have ruled that Google Analytics implementations sending data to US servers violated GDPR without adequate transfer safeguards.
Auch bekannt als: Analytics, Site analytics
- Wiretapping statute
Federal or state laws that prohibit the interception of electronic communications without consent. The federal Electronic Communications Privacy Act (ECPA) and California's Invasion of Privacy Act (CIPA) are the most commonly cited in privacy litigation involving website tracking.
Warum es wichtig ist
California's CIPA has been the basis for a substantial volume of class action lawsuits against websites that load session replay, chat, and analytics scripts, on the theory that capturing user interactions constitutes unauthorized wiretapping. Many of these cases have survived motions to dismiss, creating significant litigation exposure for organizations with California website visitors.
Auch bekannt als: CIPA, ECPA, California Invasion of Privacy Act, Electronic Communications Privacy Act
In der Praxis sehen
Erfahren Sie, welche dieser Begriffe auf Ihre Websites zutreffen
Privacy Edge scannt Ihre Web-Properties auf Netzwerkebene, identifiziert aktive Tracking-Technologien, ordnet sie Risikokategorien und Vorschriften zu und erklärt, was bei jedem Befund zu tun ist.