hugo-and-gdpr.md (4636B)
1 ---
2 title: Hugo and the General Data Protection Regulation (GDPR)
3 linktitle: Hugo and GDPR
4 description: About how to configure your Hugo site to meet the new regulations.
5 date: 2018-05-25
6 layout: single
7 keywords: ["GDPR", "Privacy", "Data Protection"]
8 menu:
9 docs:
10 parent: "about"
11 weight: 5
12 weight: 5
13 sections_weight: 5
14 draft: false
15 aliases: [/privacy/,/gdpr/]
16 toc: true
17 ---
18
19
20 General Data Protection Regulation ([GDPR](https://en.wikipedia.org/wiki/General_Data_Protection_Regulation)) is a regulation in EU law on data protection and privacy for all individuals within the European Union and the European Economic Area. It became enforceable on 25 May 2018.
21
22 **Hugo is a static site generator. By using Hugo you are already standing on very solid ground. Static HTML files on disk are much easier to reason about compared to server and database driven web sites.**
23
24 But even static websites can integrate with external services, so from version `0.41`, Hugo provides a **Privacy Config** that covers the relevant built-in templates.
25
26 Note that:
27
28 * These settings have their defaults setting set to _off_, i.e. how it worked before Hugo `0.41`. You must do your own evaluation of your site and apply the appropriate settings.
29 * These settings work with the [internal templates](/templates/internal/). Some theme may contain custom templates for embedding services like Google Analytics. In that case these options have no effect.
30 * We will continue this work and improve this further in future Hugo versions.
31
32 ## All Privacy Settings
33
34 Below are all privacy settings and their default value. These settings need to be put in your site config (e.g. `config.toml`).
35
36 {{< code-toggle file="config">}}
37 [privacy]
38 [privacy.disqus]
39 disable = false
40 [privacy.googleAnalytics]
41 disable = false
42 respectDoNotTrack = false
43 anonymizeIP = false
44 useSessionStorage = false
45 [privacy.instagram]
46 disable = false
47 simple = false
48 [privacy.twitter]
49 disable = false
50 enableDNT = false
51 simple = false
52 [privacy.vimeo]
53 disable = false
54 enableDNT = false
55 simple = false
56 [privacy.youtube]
57 disable = false
58 privacyEnhanced = false
59 {{< /code-toggle >}}
60
61
62 ## Disable All Services
63
64 An example Privacy Config that disables all the relevant services in Hugo. With this configuration, the other settings will not matter.
65
66 {{< code-toggle file="config">}}
67 [privacy]
68 [privacy.disqus]
69 disable = true
70 [privacy.googleAnalytics]
71 disable = true
72 [privacy.instagram]
73 disable = true
74 [privacy.twitter]
75 disable = true
76 [privacy.vimeo]
77 disable = true
78 [privacy.youtube]
79 disable = true
80 {{< /code-toggle >}}
81
82 ## The Privacy Settings Explained
83
84 ### GoogleAnalytics
85
86 anonymizeIP
87 : Enabling this will make it so the users' IP addresses are anonymized within Google Analytics.
88
89 respectDoNotTrack
90 : Enabling this will make the GA templates respect the "Do Not Track" HTTP header.
91
92 useSessionStorage
93 : Enabling this will disable the use of Cookies and use Session Storage to Store the GA Client ID.
94
95 {{% warning %}}
96 `useSessionStorage` is not supported when using Google Analytics v4 (gtag.js).
97 {{% /warning %}}
98 ### Instagram
99
100 simple
101 : If simple mode is enabled, a static and no-JS version of the Instagram image card will be built. Note that this only supports image cards and the image itself will be fetched from Instagram's servers.
102
103 **Note:** If you use the _simple mode_ for Instagram and a site styled with Bootstrap 4, you may want to disable the inline styles provided by Hugo:
104
105 {{< code-toggle file="config">}}
106 [services]
107 [services.instagram]
108 disableInlineCSS = true
109 {{< /code-toggle >}}
110
111 ### Twitter
112
113 enableDNT
114 : Enabling this for the twitter/tweet shortcode, the tweet and its embedded page on your site are not used for purposes that include personalized suggestions and personalized ads.
115
116 simple
117 : If simple mode is enabled, a static and no-JS version of a tweet will be built.
118
119
120 **Note:** If you use the _simple mode_ for Twitter, you may want to disable the inlines styles provided by Hugo:
121
122 {{< code-toggle file="config">}}
123 [services]
124 [services.twitter]
125 disableInlineCSS = true
126 {{< /code-toggle >}}
127
128 ### YouTube
129
130 privacyEnhanced
131 : When you turn on privacy-enhanced mode, YouTube won’t store information about visitors on your website unless the user plays the embedded video.
132
133 ### Vimeo
134
135 enableDNT
136 : Enabling this for the vimeo shortcode, the Vimeo player will be blocked from tracking any session data, including all cookies and stats.
137
138 simple
139 : If simple mode is enabled, the video thumbnail is fetched from Vimeo's servers and it is overlayed with a play button. If the user clicks to play the video, it will open in a new tab directly on Vimeo's website.
140