{
  "id": "DPE-2026-0009",
  "name": "Third-party resource loading",
  "family": "transfer",
  "summary": "A resource loaded straight from a third party makes every page view a transfer.",
  "mechanism": {
    "what": "A font, script library or image is loaded directly from an external provider instead of being served by the site. Each page view sends the visitor's IP address, and often more, to that provider.",
    "why_it_matters": "It needs no consent interaction to establish and no tracking intent to occur. It happens on the first byte, to every visitor, including those who refuse everything.",
    "common_causes": [
      "CDN link copied from documentation",
      "theme or template that references external fonts by default"
    ],
    "not_this": "This entry is about the mechanism of loading, not about the destination country. Where the data goes is a separate axis; a hotlink within the EEA is still a hotlink."
  },
  "detection": {
    "indicator": "A subresource request to a host under a different registrable domain, present in the initial document, issued without any interaction.",
    "method": "network-observed",
    "qod": 90,
    "capture_requirements": [
      "capture from a clean profile with no interaction",
      "establish the destination separately; do not infer it from the vendor's headquarters"
    ],
    "attribution": [
      "har-pageref"
    ]
  },
  "falsifiers": [
    {
      "condition": "The resource is served locally through a proxy or self-hosted copy.",
      "checkable": "automated",
      "if_true": "drop"
    },
    {
      "condition": "The request carries no data capable of identifying the visitor.",
      "checkable": "manual",
      "if_true": "weaken",
      "note": "An IP address reaches the provider in any case; that is the core of the German Google Fonts ruling."
    }
  ],
  "reproduction": {
    "methods": [
      {
        "tier": "bookmarklet",
        "path": "repro/bookmarklet/frontrun.bookmarklet.txt"
      },
      {
        "tier": "script",
        "path": "repro/web/check.mjs",
        "expect": "the run reports DPE-2026-0009 as present, with the detail behind it"
      }
    ],
    "public_scanners": [
      "urlscan.io",
      "webbkoll",
      "webpagetest"
    ]
  },
  "legal": {
    "provisions": [
      "eu-gdpr-44",
      "eu-gdpr-6-1-a"
    ],
    "caselaw": [
      "lg-muenchen-google-fonts",
      "cjeu-fashion-id"
    ],
    "rebuttals": [
      {
        "objection": "An IP address is not personal data here.",
        "answer": "The Munich ruling on Google Fonts treats hotlinking a provider resource as a transfer of personal data, precisely because the IP reaches the provider."
      },
      {
        "objection": "Our hosting is in the Netherlands.",
        "answer": "Storage location and loaded components are different things. The transfer runs through what the page pulls in, not through where it is stored."
      }
    ]
  },
  "related": [
    "DPE-2026-0008"
  ],
  "seen_in_the_wild": {
    "confirmed": false,
    "note": "Observed in practice by the authors but not yet backed by a published reference. Set to false until a citation exists: a claim without a source is exactly what this catalogue holds others to."
  },
  "schema_version": "2.0",
  "applies_to": [
    "web"
  ],
  "status": "active",
  "credit": [
    {
      "name": "Mick Beer",
      "role": "proposed",
      "date": "2026-07-26"
    }
  ],
  "does_not_establish": [
    "harm; the catalogue standardises a finding so it can be referred to, it does not weigh it",
    "severity; there is no score here, by design. Weighing belongs to whoever applies the entry to a concrete case",
    "unlawfulness; that is for a supervisory authority or a court",
    "intent; a fault is usually a build decision, not a plan",
    "absence: not finding it in one capture is not evidence that it is not there"
  ],
  "changes": [
    {
      "at": "2026-07-26T00:00:00Z",
      "actor": "registry",
      "entries": [
        "Entry created.",
        "Name assigned.",
        "Detection method and falsifiers defined.",
        "Legal provisions linked."
      ]
    }
  ],
  "slug": "third-party-resource-loading",
  "name_nl": "Externe bron inladen",
  "summary_nl": "Een bron die rechtstreeks van een derde wordt geladen, maakt van elke paginaweergave een doorgifte.",
  "in_practice": {
    "dpia": "Verify which external resources the page loads on first byte, rather than reviewing only the tracking section.",
    "procurement": "All fonts, scripts and libraries are served from the controller's own infrastructure.",
    "complaint": "A capture of the initial document with every subresource host listed.",
    "audit_question": "Which hosts does the page contact before any script of yours has run?",
    "audit_question_nl": "Welke hosts benadert de pagina voordat een script van u heeft gedraaid?",
    "complaint_nl": "Een opname of uitdraai die laat zien wat er werkelijk gebeurt, met de datum erbij en het land van waaruit is gemeten.",
    "objection_nl": "Onze hosting staat in Nederland.",
    "answer_nl": "Waar het staat en wat de pagina inlaadt zijn twee dingen. De doorgifte loopt via het inladen."
  }
}