# Hugo and the General Data Protection Regulation (GDPR)

**URL:** <https://discourse.gohugo.io/t/hugo-and-the-general-data-protection-regulation-gdpr/41582>\
**Category:** dev\
**Created:** [November 22, 2022, 9:04am UTC](https://discourse.gohugo.io/t/hugo-and-the-general-data-protection-regulation-gdpr/41582 "2022-11-22T09:04:15Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![jhvanderschee](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/jhvanderschee/32/18241_2.png) [@jhvanderschee](https://discourse.gohugo.io/u/jhvanderschee)\
**Post date:** [November 22, 2022, 9:04am UTC](https://discourse.gohugo.io/t/hugo-and-the-general-data-protection-regulation-gdpr/41582/1 "2022-11-22T09:04:15Z")

</div>

Hi everybody!

Hugo offers GDPR friendly settings. Although I really appreciate the effort, I think they may be insufficient.

The GDPR friendly settings will instruct the platforms to NOT TRACK, through the DNT-directive (do not track). However, GDPR is not about tracking, but about leaking Personal Identifiable Information (PII) to third parties. Even an IP address is considered to be PII. Your data (IP address and meta data) may end up in logs of other hosting providers or in the US governments database through systems like the PRISM project

A German court recently fined a website owner for loading Google Fonts. AFAIK you are only allowed to create LINKS TO other webpages, given that you clearly mark what website your are linking to. The website visitor is considered to give explicit consent by clicking the link. Any other form of third party content is prohibited, unless you have explicit consent (through a cookie banner for example).

**Should we change [this page](https://gohugo.io/about/hugo-and-gdpr/) in the Docs? Should we leave out the ‘GDPR’ claim and change the title of the page to ‘Privacy settings’? This would prevent the Hugo docs from giving (potentially) wrong legal advice.**

I would love to hear your opinion!

---

<div class="post-metadata">

**Author:** ![frjo](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/frjo/32/18626_2.png) [@frjo](https://discourse.gohugo.io/u/frjo)\
**Post date:** [November 22, 2022, 10:26am UTC](https://discourse.gohugo.io/t/hugo-and-the-general-data-protection-regulation-gdpr/41582/2 "2022-11-22T10:26:39Z")

</div>

I agree that it would be best to at most mention GDPR in a footnote on that page. Mentioning GDPR in the title can easily give people the wrong impression. If one read the “Note that:” part all is explained but better to be clear from the start.

---

<div class="post-metadata">

**Author:** ![jhvanderschee](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/jhvanderschee/32/18241_2.png) [@jhvanderschee](https://discourse.gohugo.io/u/jhvanderschee)\
**Post date:** [November 22, 2022, 10:40am UTC](https://discourse.gohugo.io/t/hugo-and-the-general-data-protection-regulation-gdpr/41582/3 "2022-11-22T10:40:39Z")

</div>

> [@frjo](#):
>
> mention GDPR in a footnote on that page

I like that idea!

---

<div class="post-metadata">

**Author:** ![nicfab](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/nicfab/32/15818_2.png) [@nicfab](https://discourse.gohugo.io/u/nicfab)\
**Post date:** [November 22, 2022, 11:20am UTC](https://discourse.gohugo.io/t/hugo-and-the-general-data-protection-regulation-gdpr/41582/4 "2022-11-22T11:20:21Z")

</div>

I agree with you.

It would be better to avoid misinformation about the GDPR, where the Hugo official website should contain technical information only without falling into possible legal mistakes.

Indeed, the title of the GDPR is “the protection of natural persons concerning the processing of personal data and on the free movement of such data”. Thus, the protection is related to natural persons and not data.

The common mistake is to consider that it falls under the GDPR for data protection. Instead, the protection is related to natural persons and their personal information, avoiding the unlawful processing of their personal data.

No doubt regarding the IP as personal information like others one technical.

---

<div class="post-metadata">

**Author:** ![divinerites](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/divinerites/32/12625_2.png) [@divinerites](https://discourse.gohugo.io/u/divinerites)\
**Post date:** [November 22, 2022, 4:56pm UTC](https://discourse.gohugo.io/t/hugo-and-the-general-data-protection-regulation-gdpr/41582/5 "2022-11-22T16:56:48Z")

</div>

I agree this is important to help people with such a délicate and complicated matters.

For exemple see my comment for stock GA partial.

> [@Add Minimal Analytics (Google Analytics v4) to Hugo](https://discourse.gohugo.io/t/add-minimal-analytics-google-analytics-v4-to-hugo/39016/19):
>
> Well … i understand your point, but providing tools in stock hugo that are illegal in certain countries (and not only problematic for RGPD, … really Illegal), may be needs a warning. Not everyone is aware of this.

---

<div class="post-metadata">

**Author:** ![jmooring](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/jmooring/32/4214_2.png) [@jmooring](https://discourse.gohugo.io/u/jmooring)\
**Post date:** [November 22, 2022, 10:05pm UTC](https://discourse.gohugo.io/t/hugo-and-the-general-data-protection-regulation-gdpr/41582/6 "2022-11-22T22:05:46Z")

</div>

I know almost nothing about GPDR compliance. It seems to be a moving target, requiring maintenance by someone with some smarts in this area.

Which of Hugo’s internal templates (e.g., `_internal/*`, shortcodes) have features that require compliance?

What’s the downside of deprecating these, removing them from the documentation? In short, can we make this someone else’s problem?

---

<div class="post-metadata">

**Author:** ![nternetinspired](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/nternetinspired/32/19706_2.png) [@nternetinspired](https://discourse.gohugo.io/u/nternetinspired)\
**Post date:** [November 22, 2022, 10:37pm UTC](https://discourse.gohugo.io/t/hugo-and-the-general-data-protection-regulation-gdpr/41582/7 "2022-11-22T22:37:27Z")

</div>

Anything that hits a third party server, without prior disclosure, and opt-out ability, afaik.

Hence the recently raised issue of using Google fonts, if you don’t provide a user the ability to opt-out of your fonts you are exposing that visitors ip address to Google, without their consent.

---

<div class="post-metadata">

**Author:** ![jmooring](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/jmooring/32/4214_2.png) [@jmooring](https://discourse.gohugo.io/u/jmooring)\
**Post date:** [November 22, 2022, 10:59pm UTC](https://discourse.gohugo.io/t/hugo-and-the-general-data-protection-regulation-gdpr/41582/8 "2022-11-22T22:59:41Z")

</div>

So I think this is the list that hits a third party server.

Partials

- disqus.html
- google\_analytics\_async.html
- google\_analytics.html
- google\_news.html (already deprecated)

Shortcodes

- gist.html
- instagram\_simple.html
- instagram.html
- twitter\_simple.html
- twitter.html
- vimeo\_simple.html
- vimeo.html
- youtube.html

Some old comments from others on the subject:

> <https://github.com/gohugoio/hugo/issues/7893>
>
> In light of the recent changes of the Instagram API that Facebook has enforced -…see https://github.com/gohugoio/hugo/issues/7879 for the details- 
> 
> I propose that all built-in shortcodes for 3rd party services (Twitter, Google Analytics, Instagram, YouTube, Vimeo etc) be removed from Hugo source.
> 
> Times have changed. 
> 
> The onus of third party tracking cookies should be on individual website admins and Hugo should have nothing to do with enabling this practice anymore.
> 
> Also these shortcodes come with a maintenance cost that could be spent in other areas.
> 
> If a Hugo site admin wishes to continue having the functionality of the built-in shortcodes, then they can replicate these at the project level.

---

<div class="post-metadata">

**Author:** ![jhvanderschee](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/jhvanderschee/32/18241_2.png) [@jhvanderschee](https://discourse.gohugo.io/u/jhvanderschee)\
**Post date:** [November 22, 2022, 11:15pm UTC](https://discourse.gohugo.io/t/hugo-and-the-general-data-protection-regulation-gdpr/41582/9 "2022-11-22T23:15:39Z")

</div>

> So I think this is the list that hits a third party server.

Those services are no problem/actually quite useful in non-European countries. They are also allowed in the EU when you have explicit consent. I do not think that these services/shortcodes are the point/problem.

However, providing privacy settings that claim GDPR compliancy seems like legal advice to me. You could make a footnote, as proposed. This could somehow link these privacy settings vaguely to the GDPR saying something like “These privacy settings enhance the privacy of the visitor and can be useful in the process of making a website GDPR compliant.” I would refrain from any other claim or further mention of the GDPR.

My 2 cents…

---

<div class="post-metadata">

**Author:** ![nternetinspired](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/nternetinspired/32/19706_2.png) [@nternetinspired](https://discourse.gohugo.io/u/nternetinspired)\
**Post date:** [November 22, 2022, 11:20pm UTC](https://discourse.gohugo.io/t/hugo-and-the-general-data-protection-regulation-gdpr/41582/10 "2022-11-22T23:20:39Z")

</div>

Yes, but I think we can discount those that hit a 3rd party server at render time, as that does not expose the users ppi.

Without checking I’d say that opengraph and twitter simple, possibly gist?, should be ok, they’re not ‘info-leaky’ afaik.

Update: I was wrong about the GH gist. From my test page of internal templates 😑

 ![Screenshot 2022-11-22 at 23.22.37](https://canada1.discourse-cdn.com/flex036/uploads/gohugo/original/3X/4/0/4020f269c7516f0ff54bd1d4dff63bee0b17d59f.jpeg)

---

<div class="post-metadata">

**Author:** ![jmooring](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/jmooring/32/4214_2.png) [@jmooring](https://discourse.gohugo.io/u/jmooring)\
**Post date:** [November 22, 2022, 11:23pm UTC](https://discourse.gohugo.io/t/hugo-and-the-general-data-protection-regulation-gdpr/41582/11 "2022-11-22T23:23:47Z")

</div>

Yeah, opengraph was a copy/paste error on my part. I’ll edit the list.

The gist shortcode includes:

```auto
<script type="application/javascript" src="https://gist.github.com ...

```

---

<div class="post-metadata">

**Author:** ![jhvanderschee](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/jhvanderschee/32/18241_2.png) [@jhvanderschee](https://discourse.gohugo.io/u/jhvanderschee)\
**Post date:** [November 22, 2022, 11:25pm UTC](https://discourse.gohugo.io/t/hugo-and-the-general-data-protection-regulation-gdpr/41582/12 "2022-11-22T23:25:51Z")

</div>

> [@nternetinspired](#):
>
> Yes, but I think we can discount those that hit a 3rd party server at render time, as that does not expose the users ppi.

True… but not the point IMO. Every developer in the EU knows (or should know) what is allowed. It is not the task of Hugo to produce GDPR compliant websites. You can build ANY website with Hugo: a GDPR compliant and a wildly non-compliant one. The only thing Hugo should REFRAIN from is advice you on how to achieve that. That is not the task of Hugo, it is country-specific and it is most likely incorrect… thus risky.

---

<div class="post-metadata">

**Author:** ![nternetinspired](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/nternetinspired/32/19706_2.png) [@nternetinspired](https://discourse.gohugo.io/u/nternetinspired)\
**Post date:** [November 22, 2022, 11:26pm UTC](https://discourse.gohugo.io/t/hugo-and-the-general-data-protection-regulation-gdpr/41582/13 "2022-11-22T23:26:12Z")

</div>

> [@jhvanderschee](#):
>
> when you have explicit consent

Yes, user opt-in. This is important.

---

<div class="post-metadata">

**Author:** ![nternetinspired](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/nternetinspired/32/19706_2.png) [@nternetinspired](https://discourse.gohugo.io/u/nternetinspired)\
**Post date:** [November 22, 2022, 11:29pm UTC](https://discourse.gohugo.io/t/hugo-and-the-general-data-protection-regulation-gdpr/41582/14 "2022-11-22T23:29:06Z")

</div>

A good point. It should be made clear what the potential effects of using certain inbuilt templates might be, not everyone is a professional web dev and/or lawyer.

---

<div class="post-metadata">

**Author:** ![nternetinspired](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/nternetinspired/32/19706_2.png) [@nternetinspired](https://discourse.gohugo.io/u/nternetinspired)\
**Post date:** [November 22, 2022, 11:31pm UTC](https://discourse.gohugo.io/t/hugo-and-the-general-data-protection-regulation-gdpr/41582/15 "2022-11-22T23:31:01Z")

</div>

> [@jhvanderschee](#):
>
> and it is most likely incorrect… thus risky.

I have to disagree here. I don’t see any inherent risks to privacy-first, secure by default architecture. No-one will ever be prosecuted for not giving away ppi to 3rd parties without consent.

---

<div class="post-metadata">

**Author:** ![jhvanderschee](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/jhvanderschee/32/18241_2.png) [@jhvanderschee](https://discourse.gohugo.io/u/jhvanderschee)\
**Post date:** [November 22, 2022, 11:33pm UTC](https://discourse.gohugo.io/t/hugo-and-the-general-data-protection-regulation-gdpr/41582/16 "2022-11-22T23:33:46Z")

</div>

> [@nternetinspired](#):
>
> A good point. It should be made clear what the potential effects of using certain inbuilt templates might be, not everyone is a professional web dev and/or lawyer.

Should it? I think we cannot and won’t fix that for them. Wix, Wordpress and Squarespace are neither solving that for their customers (just to name a few website builders). GDPR is very complex. Hugo should draw the line at privacy settings and SHOULD leave the rest to professionals and lawyers.

---

<div class="post-metadata">

**Author:** ![jhvanderschee](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/jhvanderschee/32/18241_2.png) [@jhvanderschee](https://discourse.gohugo.io/u/jhvanderschee)\
**Post date:** [November 22, 2022, 11:40pm UTC](https://discourse.gohugo.io/t/hugo-and-the-general-data-protection-regulation-gdpr/41582/17 "2022-11-22T23:40:02Z")

</div>

> [@nternetinspired](#):
>
> No-one will ever be prosecuted for not giving away ppi to 3rd parties without consent.

🙂 true! I love your enthusiasm.

I meant that the current privacy friendly options at the current ‘Hugo and GDPR’ page might be not GDPR compliant, thus risky. I agree that privacy by design is a good approach, but it is far from mainstream and only relevant in the EU (and California?)… Therefore, removing all third party requests might be one bridge to far for now.

---

<div class="post-metadata">

**Author:** ![jmooring](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/jmooring/32/4214_2.png) [@jmooring](https://discourse.gohugo.io/u/jmooring)\
**Post date:** [November 22, 2022, 11:41pm UTC](https://discourse.gohugo.io/t/hugo-and-the-general-data-protection-regulation-gdpr/41582/18 "2022-11-22T23:41:47Z")

</div>

To be clear, I am not advocating removal of internal partials and shortcodes. I’m just putting the idea out there for discussion.

It _seems_ like the GPDR concerns can be addressed with documentation as @jhvanderschee suggests.

Unrelated to GPDR, we also have this:  
[https://github.com/gohugoio/hugo/labels/EmbeddedTemplate](https://github.com/gohugoio/hugo/labels/EmbeddedTemplate)

Some of these are things that are broken, and some are improvements. Making them someone else’s problem is attractive, but again, I am not advocating their removal.

How another SSG handles it:  
[https://github.com/topics/jekyll-plugin](https://github.com/topics/jekyll-plugin)

---

<div class="post-metadata">

**Author:** ![divinerites](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/divinerites/32/12625_2.png) [@divinerites](https://discourse.gohugo.io/u/divinerites)\
**Post date:** [November 23, 2022, 6:38am UTC](https://discourse.gohugo.io/t/hugo-and-the-general-data-protection-regulation-gdpr/41582/19 "2022-11-23T06:38:53Z")

</div>

> [@jhvanderschee](#):
>
> They are also allowed in the EU when you have explicit consent.

No.  
Not in France, Austria, …  
related to where the data are stored.

But I agree with @jmooring, this is not Hugo job to be RGPD or whatever compliant.

But it is Hugo responsability to warn the user when they use a template/shotcode who can be problematic or illegal.

And i agree with his list of template/shortcode concern.

---

<div class="post-metadata">

**Author:** ![devsr-gt](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/devsr-gt/32/15058_2.png) [@devsr-gt](https://discourse.gohugo.io/u/devsr-gt)\
**Post date:** [November 23, 2022, 9:36am UTC](https://discourse.gohugo.io/t/hugo-and-the-general-data-protection-regulation-gdpr/41582/22 "2022-11-23T09:36:38Z")

</div>

Harry I took care of it.

[![](https://img.youtube.com/vi/2hOLm_k6eCs/hqdefault.jpg "Dumb and Dumber (1/10) Best Movie Quote - Shrimp on the Barbie (1994)") ](https://www.youtube.com/watch?v=2hOLm_k6eCs)

[Next page](https://discourse.gohugo.io/t/hugo-and-the-general-data-protection-regulation-gdpr/41582.md?page=2)