Jens Oliver Meiert

Get 15% off on select books on Gumroad—use discount code “testdrive”.

Web Development and the GDPR

Post from August 31, 2018 (↻ May 29, 2021), filed under .

Who shares or presents code has a special responsibility, because for both the uninitiated and the quality-minded such code should be of a considerable standard. We’ve known this responsibility for ages, whether from ad networks with dubious pseudo-HTML to social media companies with invalidating gadget code to frameworks and libraries and polyfills and shims with their sometimes “plug & play don’t care” approach to web development.

With the European General Data Protection Regulation (GDPR), this has become even more important.

Where formerly, one often pointed to some third-party script or style sheet—e.g., or https://maxcdn.bootstrap­—, we’re now confronted with another problem in that such simple hot-linking resources is clearer than ever a privacy issue for: everyone.

Why is that? Because blindly referencing foreign-origin URLs (that is, embedding resources without any referrer policy in place) exposes referrer information to those foreign origins, and with that means a privacy hazard. This is especially true with organizations in countries with lax privacy provisions, and with script or style providers who live off data, like Google or Facebook.

As such, then, what formerly looked user-friendly and innocent carries now even more weight. Not only be the ambition to offer quality code (which includes secure and fast code as well as, per my own taste, also minimal code), but also to be less suggestive, and indeed perhaps quite a little less usable, when it comes to plug-in play privacy cuts.

Kosugi embed dialog on Google Fonts.

Figure: How easy it is to embed Kosugi. (Privacy? Alternatives?)

What should be done? Perhaps, as I suggested to Robert and Tim after a Google Developers Experts call, we could start with using local references in code samples, and providing the full URLs (and said privacy context) in footnotes. That might bring awareness and attention to the issue without making the samples unusable. Especially with huge enterprises like Google, any code sample comes off as a recommendation or even a best practice, and so Google and other major tech firms turning more mindful, and looking more closely at the matter of responsible code sharing, could set a great precedent.

Update (October 12, 2020)

A few months ago I outlined what good embed code rests on, and what developers and users of such code could pay attention to.

About Me

Jens Oliver Meiert, on September 30, 2021.

I’m Jens, and I’m an engineering lead—currently manager for Developer Experience at LivePerson—and author. I’ve worked as a technical lead for Google, I’m close to W3C and WHATWG, and I write and review books for O’Reilly. I love trying things, sometimes including philosophy, art, and adventure. Here on I share some of my views and experiences.

If you have a question or suggestion about what I write, please leave a comment (if available) or a message. Thank you!

Read More

Maybe this is interesting to you, too:

Looking for a way to comment? Comments have been disabled, unfortunately.

Cover: The Web Development Glossary.

Get a good look at web development? Try The Web Development Glossary (2020). With explanations and definitions for literally thousands of terms from Web Development and related fields, building on Wikipedia as well as the MDN Web Docs. Available at Apple Books, Kobo, Google Play Books, and Leanpub.

Stay up-to-date? Learn about new posts by feed or on Twitter.

Found a mistake? Email me,

You are here: HomeArchive2018 → Web Development and the GDPR

Last update: May 29, 2021

Professional frontend developers produce valid HTML and CSS.