GDPR & ePrivacy Compliance
for Link Tracking

The legal test isn't "do you use cookies?"

Most conversations about tracking compliance focus on cookies. But the actual legal test under Art. 5(3) of the ePrivacy Directive is broader:

The EDPB Guidelines 2/2023 confirm this covers not just cookies, but also URL tracking identifiers, IP-based tracking, and any access to information on the user's device.

trckl.eu's answer to this test: no. We never write to, read from, or instruct the user's device to send us anything beyond the standard HTTP request their browser makes when following a link — which is the explicit, user-initiated action that triggered the redirect.

What actually happens during a redirect

When someone clicks a trckl.eu link, this is the complete sequence:

• 1User clicks the link — an explicit, user-initiated HTTP request
• 2Browser sends a standard HTTP GET to our EU servers
• 3Server receives: IP address, User-Agent, Referrer — standard HTTP protocol headers
• 4Analytics worker runs asynchronously: computes SHA256(IP + User-Agent + daily_salt)
• 5Raw IP is discarded — never written to disk, never in any log
• 6Anonymous event written: country, device type, referrer, hash — no PII
• 7HTTP 301/302 response sent — user arrives at destination

Nothing is written to the user's device. No cookie, no local storage, no cache instruction. The HTTP request headers we receive are standard protocol — not data we solicited.

Why no consent is required

Art. 5(3) ePrivacy Directive includes an explicit exemption for processing "strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service."

A redirect is the archetypal case: the user explicitly clicks a link, explicitly requesting the redirect service. Receiving the IP address to route the HTTP 301 response back is not optional — it is technically impossible to respond without it. There is no alternative implementation that achieves the same result with less data.

The EDPB Guidelines §56 confirm: "the applicability of that article does not systematically imply that consent must be collected. In each case it should be assessed whether consent is necessary or whether an exemption under Art. 5(3) may apply."

We assessed it. The exemption applies. That assessment is this document.

IP hashing — the promise in numbers

Even under the strictly necessary exemption, we go further. We do not store the IP address even transiently. Here is the exact mechanism:

The daily salt rotates every 24 hours. This means the same user generates a different hash on different days — making it mathematically impossible to reconstruct a user's navigation history over time, even if you had access to all hashes ever computed.

The raw IP address is processed in memory and immediately discarded. It is never written to disk, never passed to a database query, never included in any log file.

Why zero cookies is non-negotiable

Cookies are not a convenience — they are a legal trigger. Setting even a single cookie during a redirect means:

• 1Art. 5(3) ePrivacy Directive is activated without any exemption available
• 2Consent is required — meaning every company using our links must update their cookie banner
• 3Cross-session user tracking becomes possible — creating a personal data processing obligation under GDPR Art. 6

Our zero-cookie architecture means companies using trckl.eu links do not need to update their cookie consent infrastructure. The link just works — legally, for their users.

Why EU infrastructure is the guarantee, not the GDPR

The GDPR does not prohibit transferring data outside the EU — it requires a legal mechanism (SCCs, adequacy decisions). A US company with servers in Germany can be technically GDPR-compliant with the right contractual framework.

The CLOUD Act is a different problem. It compels any US-based company to produce data to US authorities on request — regardless of where the servers are physically located. Standard Contractual Clauses do not protect against CLOUD Act requests.

The only real protection is infrastructure owned and operated by a company outside US jurisdiction.

What you can document in your RoPA

When adding trckl.eu to your Records of Processing Activities, here is what you can record:

• ✓Data processor: trckl.eu — EU-incorporated entity, EU infrastructure
• ✓Data processed: Anonymous click events (country, device type, referrer, daily-salted hash). No IP addresses. No personal identifiers.
• ✓Legal basis (ePrivacy): Art. 5(3) strictly necessary exemption — redirect service explicitly requested by user
• ✓Legal basis (GDPR): Legitimate interest (Art. 6(1)(f)) — anonymous analytics for service improvement. No personal data processed.
• ✓Third-country transfers: None. All processing on EU infrastructure.
• ✓Data retention: Configurable — 90 days / 1 year / unlimited (plan-dependent)
• ✓DPA: Available and signable (Business plan and above)

Questions about this architecture? We're happy to discuss technical details with your legal team. Contact us at [email protected].

Questions DPOs and legal teams ask