And especially when it comes to the last point of advantages, most people should think: “But what’s the catch here?”. Of course, Google, Facebook and Co. do not make their content available completely without their own benefit or without costs:<\/p>\n
Data from website users is collected via the content provided, which in turn can be used to display individually tailored advertising – the main business of Google, Facebook and Co.<\/p>\n
What options are there for third-party content to be added?<\/h3>\nAnd what does that look like from a data protection perspective?<\/h3>\nIframes<\/h3>\n
Iframes<\/h3>\n
TheInline frames<\/strong>(Short form: iframes) are separate areas (windows) on a website whichOutput content from another, third party website<\/strong>. This can only be small areas of the third website, or the entire page.<\/p>\n The so-called iframe is created with the HTML tag <iframe> called up, in which the exact link to the displayed content is located.<\/p>\n MostSocial media plugins<\/strong>, or YouTube, for example, work with this method. Facebook has had a new format (XFBML) for some time now, but the majority still uses the “Iframe” solution.<\/p>\n The advantages of iframes are great becausewithout any programming effort<\/strong>Have great functions integrated into a website. All you have to do is install the iframe code and videos, calculators, complex forms or other content can be accessed via it.<\/p>\n Out offrom a data protection perspective<\/strong>must be checked whether the integrated iframecollects and shares data<\/strong>. Technically speaking, it is possible to collect and process data such as the user’s IP address or the URL of the target page.<\/p>\n About an already previously setCookies<\/strong>information can be read out. Here is a small example to make it clearer:<\/p>\n A user watches a video on YouTube. From there, a cookie is placed on the user’s computer, which normally always happens. If the user then visits another website and a YouTube video can be found on it, the information from the cookie can be retrieved.<\/p>\n From a legal point of view, the ECJ has interpreted the concept of responsibility broadly, which is whyshared responsibility<\/strong>within the meaning of Article 26 GDPR.<\/p>\n However, the joint responsibility ends when the operator of the website has no influence on the third party’s data processing. Client-side script code is a more modern way to include external content on the website. Functions can be displayed on the page with an HTML fragment or a JavaScript code.<\/p>\n Similar to the iframe, the third-party content is retrieved from another web server, which has various advantages, such as:<\/p>\n Of course you give itcontrol<\/strong>about parts of your own website (the third-party content). In addition, it must be in the web browserJavaScript activated<\/strong>so that the content can also be displayed. In this case, the all-clear can be given because JavaScript is deactivated in only around 1%.<\/p>\n The most common technologies that are integrated using this method are Google Analytics, Google AdSense, Google Fonts, Google Maps and sometimes also videos from YouTube and Vimeo.<\/p>\n Google Fonts has now gained an incredible presence on the Internet. Almost every small and medium-sized business website uses Google’s service. It’s easy to explain why Google Fonts is so successful. The website operators receive a huge fundvarious web fonts<\/strong>in all possible weights and styles (bold, italic) and free of charge.<\/p>\n In addition, Google Fonts is veryeasy to integrate<\/strong>. A distinction is made between the “online” variant and the “offline” variant.<\/p>\n The easier and faster way is the online version. Here you just have to choose any font and then click on the website with a <link> or an @import tag. This means that the font is retrieved from the Google server and thus integrated online.<\/p>\n The second way is to download the file from the Google Fonts website and embed it on your own website like any other web font. With this method, the font is loaded directly from your own web server.<\/p>\n From a data protection perspective, Google Fonts must be treated specifically. Google collects data from website users and Google Fonts is used in most caseseven before consent<\/strong>loaded. There is no court ruling on this yet, but it is strongly recommended to use the offline version, as the fonts are then loaded from your own web server.<\/p>\n If you absolutely want to use the online version, you should definitely add a note in the data protection declaration and also try to use the CMP to block Google Fonts before giving your consent.<\/p>\n To use Google Maps, you can either choose the iframe version (see above) or you can integrate it via the Google Maps API. At theAPI method<\/strong>Google’s map accesses are determined via an API key. With a certain number of views, Google’s service is subject to a fee.<\/p>\n AbsolutelyScreenshots of Google Maps are not allowed<\/strong>. This is strictly prohibited and will also be legally punished by Google.<\/p>\n From a data protection perspective, it’s the same as with Google Fonts. Google also collects data from users who are on the website. For this reason, consent should first be obtained using the CMP. There should also be a note in the data protection declaration that Google collects data. Since there is no offline method here, the steps mentioned above are strongly recommended.<\/p>\n As with the two examples of Google Maps and Google Fonts mentioned above, the problem here is that YouTube collects data as soon as the user is on a website in which YouTube videos are embedded. There are now several options to prevent the collection of data or to make it more difficult:<\/p>\n To enable enhanced data protection modeactivate<\/strong>, you simply have to open the desired video on YouTube. Then click on “Share” and select the “Embed” function in the next step. Now you have to scroll a little. In the “Embed options” you will find the desired “enhanced data protection mode”, which must be activated. With this option the link of the iframe changes from “www.youtube.com” to “www.youtube-nocookie.com”.<\/p>\n With this method, data is still transferred to YouTube, but no personal data. This option must be activated for every video on the website.<\/p>\n With this method you can embed the videos as usual, but consent for YouTube must be obtained again via the CMP. If you don’t have consent, the video may not be loaded.<\/p>\n The last method and a rather uncharming solution is to insert a link. This directs the user to the desired video on YouTube. However, this has the big disadvantage that the user leaves the page and the link can easily be overlooked.<\/p>\n In the first two cases (enhanced privacy mode and consent for YouTube), it is strongly recommended to add a note in the privacy policy.<\/p>\n As you can see, the different tools have to be treated very similarly and basically the same steps are always recommended:<\/p>\n
\nNevertheless, it should always be checked whether personal data is obtained from the third party and, if so, what and how it is used.So it’s crucial to know whether the iframes are collecting, processing or sharing information. If this is the case, further steps must definitely be taken:<\/strong><\/p>\n\n
HTML fragment or client-side script code<\/h3>\n
\n
Most popular services and recommendations<\/h2>\n
Google Fonts<\/h3>\n
![\"\"](\"https:\/\/e-dialog.group\/wp-content\/uploads\/2025\/08\/e-dialog-blogbeitrag-google-fonts.jpg\")
Google Maps<\/h3>\n
YouTube<\/h3>\n
Advanced data protection mode<\/h3>\n
![\"Datenschutz](\"https:\/\/e-dialog.group\/wp-content\/uploads\/2025\/08\/e-dialog-blogbeitrag-datenschutz-youtube.jpg\")
Consent for YouTube<\/h3>\n
Just add a link<\/h3>\n
Conclusion<\/h2>\n