GDPR

What it is

The General Data Protection Regulation, in force since May 2018. Governs how organisations process personal data of EU residents — lawful basis, consent, data subject rights, breach notification. Extraterritorial: EU residency of the data subject is what matters, not where the company is.

Why it matters

Maximum fines reach 4% of global annual revenue. Beyond fines, GDPR shapes user expectations everywhere — clear consent and a real privacy policy are now baseline trust signals globally.

Who it applies to

Applies wherever EU residents' personal data is processed — effectively any site with EU traffic that uses analytics or tracking.

How WQI scores it

Web Quality Index considers this standard satisfied when all of the 3 supporting factors pass.

0 of 3 supporting factors are currently collected. Sites where the remaining 3 haven't been measured will show as partial or unknown on this standard until the data lands.

Related standards

See also

CCPA , Cookie consent , LGPD , PIPEDA , POPIA , Privacy Act (AU) , Law 25

Standards that share factors with this one

Auto-computed from overlapping factor tickets in satisfiedBy, excluding standards already listed under "See also" above. Strong overlap suggests these standards rise and fall together when sites are scored.

• Colorado Privacy Act 3 shared factors Privacy Colorado's CCPA-shaped privacy law, with a hard requirement to honour Universal Opt-Out Mechanisms like Global Privacy Control as of July 2024.
• Connecticut Data Privacy Act 3 shared factors Privacy Connecticut's CCPA-shaped privacy law. Like Colorado, recognises Global Privacy Control as a valid opt-out signal — and the AG has been actively issuing cure notices since 2023.
• COPPA 3 shared factors Privacy If your site is directed at U.S. children under 13 — or you knowingly collect from them — you need verifiable parental consent before any data collection. The 2025 amendments tightened this further around third-party advertising.
• HIPAA 3 shared factors Privacy If your site collects, displays, or transmits protected health information, HIPAA applies. A privacy policy plus an explicit Notice of Privacy Practices and a clear consent flow are the minimum visible signals.
• Oregon Consumer Privacy Act 3 shared factors Privacy Oregon's CCPA-shaped privacy law. Distinctive for explicitly covering nonprofits (after a one-year delay) and for a specific right to know which third parties received your data.

Other references

• guidance European Data Protection Board (EDPB) guidelines
• case-law Schrems II ruling (CJEU C-311/18)