CLOUD Act: is your website exposed?
Yes, as soon as one of your website's providers is subject to US law. The CLOUD Act, passed in 2018, requires such a provider to hand over the data it holds to US authorities, even when its servers are in Europe.
Your host is not the only one involved: DNS, content delivery (CDN), fonts, analytics and email each have their own provider. That is what our audit checks on a website's independence.
What the law allows, and what it does not say
The Clarifying Lawful Overseas Use of Data Act amends a US law on stored communications. Its central provision, codified at 18 U.S.C. § 2713, requires a provider to disclose data "within such provider's possession, custody, or control", wherever that data is stored.
The law applies to criminal investigations, at the request of a judicial authority. It does not give open access to all data, and it says nothing about how many requests are made.
What matters is the law the provider is subject to, not the address of the server. A US company that hosts your website in Paris is still covered.
The CLOUD Act and the GDPR answer different questions
The GDPR governs data leaving the EU. Its Article 48 states that a decision by a non-EU authority is only recognized in the EU if it rests on an international agreement. The CLOUD Act addresses the provider, which remains bound by its own country's law, so the two texts can conflict.
The EU-US Data Privacy Framework, adopted on 10 July 2023, allows transfers to certified US companies. The EU General Court upheld it on 3 September 2025, and an appeal is pending before the Court of Justice. The framework governs transfers. It does not remove the CLOUD Act.
What we find on the sites we audit
85%send personal data outside the European Union without safeguards during a simple visit
75%rely on a single provider for several critical layers
These percentages cover about 30 websites we audited between August 14, 2026 and September 24, 2026. Each one counts only the sites where the point could be checked. Many were audited because a defect showed up quickly, so these figures describe our audits, not websites in general.
What the audit looks at, layer by layer
A website rests on several layers, and each has its own provider. For each one, the audit establishes who provides it and which law that provider is subject to.
- Hosting, which stores the site and its data. It is the layer people think of, and rarely the only one involved.
- DNS, which sends visitors to your server. If its provider goes down, your site can no longer be found.
- Content delivery (CDN), often placed in front of the host. All traffic passes through it, and it can be subject to a different law than the host.
- Services called by your pages: fonts, analytics, videos, bot protection. They receive every visitor's IP address, often as soon as the page opens.
- Email, which receives messages for your domain, including your exchanges with customers.
The report names the provider of each layer, the law it is subject to, and the layers that rely on the same provider.
What moves easily, and what takes a project
Services called by your pages are the easiest to replace: fonts served from your own server, analytics run by a European company. The guide on what your website sends outside the EU explains why these services matter.
Hosting, DNS and email need a planned migration. The guide on choosing EU web hosting lists the questions to ask a provider.
What this check doesn't tell you
For each provider visible from the outside, we establish the country of its company and of its servers. We cannot see your contracts, your backups or your providers' subcontractors.
This guide is not legal advice. Whether a transfer or a contract is compliant is a question for your data protection officer or a lawyer.
Read next
What your website sends outside the EU
A visit can send your visitor's IP address outside the EU (fonts, analytics, videos). Why it counts as a transfer, and what the audit records.
Read the guide →EU web hosting: more than server location
A server in the EU is not enough: your host's jurisdiction, DNS, CDN and email matter too. The questions to ask before you choose.
Read the guide →