GDPR problem with loading external source cdn.plyr.io

  • Resolved doffine

    (@doffine)


    1 year, 2 months ago

    Hi @shehabulislam,

    we noticed a problem that can make the plain usage of your plugin illegal in the European Union in terms of GDPR. The reason is that you are loading the player JS from an external CDN (cdn.plyr.io).

    The website visitor has no chance to decline it: As soon as he enters the page with your plainly installed player, his browser connects to this external source. So the external CDN gets to know about the IP address and so on (that is “individual-related data” from the EU law’s point of view) of the page visitor. This is illegal in terms of the European Union’s GDPR law.

    I know European Union might be far away from you but plenty of websites using your plugin now or hopefully in future are located in the EU and you put them all to the risk of getting a written warning with costs of some lawyers.

    We had this problem before with an Open Street Map WordPress plugin that did load the map viewer JS from an external CDN, too. This plugin author realized the GDPR problem after we reported it to him and he simply put the JS file into his WordPress plugin itself instead of loading it from the external CDN. This really should be no performance or loading speed problem nowadays – your player JS currently is 112 kB in size.

    I hope you realize the importance of this. There are other possibilities like putting your plugin’s videos behind a GDPR consent tool. But you really would make lifes of many (current and future) users (out of about a whole continent) of your plugin more safe or easier by just putting the JS into your plugin.

    Would it be possible that you think about doing this? We know EU’s data protection laws often are annoying, especially for programmers in other parts of the world. But laws are laws and money to be paid to lawyers finding such GDPR violations is money. And just putting the JS into your plugin hopefully shouldn’t be such a problem.

    We are looking forward to hear from you and thank you a lot for your work,
    -doffine

Viewing 4 replies - 1 through 4 (of 4 total)
  • Plugin Author shehabulislam

    (@shehabulislam)

    Hello @doffine,

    Thank you for your suggestion. we removed the CDN links.

    please check and let us know.

    Thread Starter doffine

    (@doffine)

    Hi @shehabulislam,

    we checked it and the external source disappeared. Great that you did this.

    This is excellent and quick work and good for every user in the EU. So locally hosted videos can be put on the website without letting them be extra consent-clicked prior to loading the player from the external source.

    We just noticed that now with the local player JS it seems to be in kind of a verbose mode and writing a lot of lines in the browser console (most are generated in VideoPlayer.js:63:14). For every embedded video on a page two lines are added into the console. Perhaps you want to switch that “verbose mode” off for the live version of your plugin? If every JS would write so much in the console, it would be full and you wouldn’t find anything there.

    And second, if we expand one of those verbose lines in Firefox console:

    Object { media: video#player , videoSource: undefined } VideoPlayer.js:63:14

    …we find in there:

    <video id="player" class="" data-poster="" src="https://cdn.plyr.io/static/blank.mp4" preload="metadata" style="width: 100%; max-width: 100%;" controls="">
    videoSource: undefined

    So there somehow still is something to be read of “cdn.plyr.io”. We don’t know what this means, since no external source is to be seen elsewhere. So perhaps it would be enough to switch off that “verbose mode”?

    Greetings and thanks so much for your great work,
    -doffine

    Plugin Author shehabulislam

    (@shehabulislam)

    Hello

    Removed this code from console.

    Thank you

    Thread Starter doffine

    (@doffine)

    Hi @shehabulislam,

    great, the problem is gone now.

    Thank you a lot,
    -doffine

Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘GDPR problem with loading external source cdn.plyr.io’ is closed to new replies.