Website Tracking and GDPR: Why Browser Behavior Matters
Website tracking can collect and share personal data during a live browser session. Privacy teams need to understand that behavior alongside their consent and vendor records. Cookie notices, vendor contracts, and privacy policies describe intended practices. On their own they do not show which scripts and tags actually run, what data they access, or where they send it.
Different rules govern different parts of this activity. French cookie enforcement applies national law implementing the EU ePrivacy Directive. The GDPR governs relevant personal-data processing, including transparency, security, data minimization, and international transfers.
In 2025, France’s CNIL fined SHEIN €150 million over website cookie practices and Google €325 million over advertising cookies during account creation and ads within Gmail. Separately, Ireland’s Data Protection Commission fined TikTok €530 million over transfers of EEA users’ personal data involving remote access from China.
These decisions support a practical question for website owners: can they explain what happens to personal data in the browser and show that it matches the rules applicable to each activity?
Cookie enforcement examines actual site behavior
In the SHEIN case, CNIL found that some cookies were placed before users had consented, information about advertising purposes and third parties was incomplete, and refusal or withdrawal did not fully stop cookie activity. CNIL enforced Article 82 of the French Data Protection Act, which implements ePrivacy rules on cookies. The decision was not a GDPR fine.
Does the website behave the way the consent experience says it behaves?
The answer is difficult to prove. Marketing teams add tags. Agencies manage campaign pixels. Consent management platforms trigger categories. Tag managers call additional scripts. Vendors load fourth parties. A privacy team may approve a tool once, but that approval does not guarantee the same runtime behavior months later.
The risk appears when the live site diverges from the governance record. A user rejects advertising cookies, but a tag still fires. A vendor categorized as analytics begins accessing identifiers used for advertising. A script approved for conversion measurement reads form data. A consent string is passed through an ad-tech ecosystem in a way the company cannot fully explain.
The SHEIN decision illustrates the need to compare the consent experience with observed cookie behavior. Whether related personal-data processing also complies with GDPR requires a separate assessment.
Cross-border transfers require separate analysis
Analytics tools can create cross-border transfer exposure when they collect online identifiers, device data, IP addresses, browser information, or other personal data and make that data available outside the EEA.
A 2022 Italian Garante decision examined one website’s use of Google Analytics and the transfer of personal data to the United States without adequate safeguards at that time. The authority treated IP addresses as personal data in that context. The decision concerned the configuration and transfer arrangements then in place; it does not make every analytics implementation unlawful today.
The EU-U.S. Data Privacy Framework changed the transfer landscape for covered transfers to certified U.S. organizations. The European Commission adopted an adequacy decision in July 2023, and the EU General Court dismissed a challenge to that decision in September 2025. Organizations still need to check the recipient’s certification, the data involved, and any other applicable transfer arrangements.
The Irish Data Protection Commission’s TikTok decision concerned access from China to EEA user data and the adequacy of the safeguards and information provided to users. It was not a finding about a website script. The case shows why remote access and transfer arrangements matter, but it does not establish that observing a script’s network destination proves where personal data is processed or whether a restricted transfer occurs.
For websites, script and network observations can prompt a transfer investigation. The privacy and legal teams must confirm the recipient, access arrangements, processing location, and applicable GDPR transfer mechanism.
Ad-tech rulings expand accountability for consent strings and profiles
Ad tech has also received significant scrutiny from the Court of Justice of the European Union.
In IAB Europe, the Court of Justice examined the Transparency and Consent Framework and the TC String used to record user preferences. It explained that a TC String can constitute personal data when it is possible to identify the user, and that controller responsibilities depend on the party’s role in determining the purposes and means of the relevant processing.
In Schrems v. Meta, the Court of Justice held that GDPR data minimization limits a social network’s use of personal data for targeted advertising across time and data types. The ruling concerns that processing and should not be read as a blanket finding about every website using an advertising pixel.
Websites using advertising pixels, tag managers, and consent tools should examine the actual data flows and the roles of the parties involved. The legal consequences depend on those facts. A useful operational question is which third parties run on the site, what data they can access, and whether their observed behavior matches the organization’s documented purpose and the user’s choices.
Third-party scripts create a runtime privacy gap
Modern websites depend on JavaScript. Analytics, personalization, chat, A/B testing, fraud tools, payment widgets, consent management, and advertising all rely on code executing in the user’s browser. That code often comes from third parties and those third parties may call additional fourth and nth parties. The website owner often does not directly review, approve, or control every script that appears in the session.
Uncontrolled third-party code can expose personal data in the browser before it reaches the web server. Source Defense provides visibility into script behavior and configured controls that can restrict unauthorized access to sensitive inputs. Source Defense’s analysis included in the 2024 Verizon Payment Security Report documented extensive third- and fourth-party script activity across the large merchant websites it studied. Those findings illustrate potential exposure; each organization still needs to assess the scripts and data flows on its own site.
A consent banner and a vendor register cannot establish what every script did during a user session. Browser observations can help teams find behavior that needs investigation and compare it with their governance records.
A practical control model for website data ecosystems
A website privacy program can connect legal and vendor decisions to observed browser behavior. The applicable obligations and the safeguards needed will depend on the organization’s processing activities.
A practical model includes:
1. Script inventory
Maintain a current inventory of first-party, third-party, fourth-party, and nth-party scripts running on sensitive pages and across the broader customer journey.
2. Purpose and justification
Document why each script is present, which business owner uses it, which category it belongs to, and whether its purpose matches the consent experience and privacy notice.
3. Data access mapping
Identify which scripts can access identifiers, cookies, local storage, form fields, payment data, credentials, health data, financial data, location data, or other sensitive inputs.
4. Consent alignment
Test whether the consent platform and tags behave as intended when a user rejects, withdraws, or changes a choice. A script-monitoring tool does not determine the lawful basis for processing or implement consent on its own.
5. Transfer assessment
Use observed data flows to identify questions for further investigation. Confirm recipient identity, remote-access arrangements, processing locations, and transfer mechanisms with vendors and legal advisers; do not infer a restricted transfer from a network destination alone.
6. Runtime monitoring and change detection
Detect new scripts, changed scripts, changed data access patterns, and unexpected destinations. Static records age quickly because tag managers and third-party services change frequently.
7. Preventive controls
Apply controls that limit what scripts can read, write, and transmit, especially on pages where users enter sensitive data.
How Source Defense supports client-side privacy and security control
Source Defense can support a website privacy program by helping teams observe and govern script behavior where its controls are deployed.
The platform provides visibility into first-, third-, and fourth-party scripts and their observed behavior. Source Defense Protect uses browser-side JavaScript sandboxing and configured policy modes to restrict selected script execution or access to page elements and sensitive form data. Monitored mode observes behavior; Isolated, Redacted, and Blocked modes apply different controls where configured. These capabilities can help reduce unauthorized data access at the point of input.
A script may access a form field before the data reaches the server, and a new dependency may appear without a new procurement review. Script and network observations can reveal activity for investigation, while the organization determines whether the processing is authorized, whether a user choice applies, and where any recipient actually processes the data.
Source Defense can contribute script inventories, behavior observations, alerts, and configured access controls to security and privacy reviews. The organization remains responsible for consent, lawful basis, vendor due diligence, transfer assessments, and GDPR compliance.
The same capabilities also support security outcomes. Source Defense’s 2025 eSkimming Landscape Report documented increasingly sophisticated attacks using Google Tag Manager abuse, double-entry overlays, WebSockets, silent skimming, first-party script injection, and trusted service abuse. Those tactics show why privacy and security teams need to treat the browser as a governed environment, not a blind spot.
Connecting browser evidence to privacy governance
The cookie and GDPR decisions discussed here address different legal questions. Together, they show why organizations should verify relevant browser activity and assess personal-data processing against the rules that apply to it. Records of consent, vendor relationships, and transfer decisions become more useful when teams can compare them with evidence of which scripts ran and what access or communications were observed. A technical observation cannot by itself establish a legal basis, confirm a recipient’s location, or prove compliance.
The browser is where analytics, advertising, consent, payment, and customer experience technologies happen. It’s also where personal data can be collected, shared, transferred, or stolen before it ever reaches the server. Privacy, security, and web teams can use those observations to investigate unexpected behavior and configure controls around sensitive inputs. Legal and privacy owners decide what processing is permitted and what additional action is required.
Request a client-side privacy and security assessment to examine which scripts run on your website, what access they may have, and which behaviors merit investigation.
FAQ
Does GDPR prohibit third-party scripts?
No. GDPR does not prohibit third-party scripts as a category. The issue is whether the processing is lawful, transparent, limited to a defined purpose, properly secured, and supported by the right controls. Website owners need to understand and control what third-party scripts do in the browser.
Are analytics tools illegal under GDPR?
No tool is automatically illegal in every configuration. Analytics risk depends on the data collected, legal basis, consent model, retention, vendor role, transfer mechanism, and safeguards. Earlier Google Analytics decisions show that regulators will examine the actual data collected and transferred, not only the tool name.
Is a cookie banner enough to address website tracking obligations?
A banner presents choices, while the site must also respect the applicable rules when placing or reading cookies and processing personal data. In its SHEIN decision, CNIL examined whether cookies appeared before consent and whether refusal or withdrawal worked in practice. Those cookie findings were under French law implementing ePrivacy rules.
How do cross-border transfers affect website scripts?
A website script may collect or transmit personal data in a way that raises GDPR transfer questions. Observed traffic is a starting point. Confirm the recipient, access and processing arrangements, and any applicable transfer mechanism before reaching a legal conclusion.
How does client-side security support GDPR programs?
Client-side security can help identify scripts, monitor their behavior, detect changes, and restrict access to sensitive inputs where controls are configured. These capabilities can support privacy investigations and safeguards, while the organization remains responsible for legal compliance.
