Privacy · · updated
Data minimization under GDPR and CCPA for web workflows
GDPR Article 5(1)(c) requires personal data to be adequate, relevant, and limited to what is necessary. A client-side converter that never accepts an upload does not process the file as a controller on a server. CCPA purpose limitation is the same idea: do not take bytes you do not need. Test any page with a Network-tab audit before you trust a privacy policy.
What is a processor if there is no upload?
A controller determines purposes. A processor processes on behalf of a controller. If your origin has no file endpoint, you never obtained the document. You still control cookies and analytics on the HTML shell. Keep those datasets separate from the myth that “using the tool” equals “we saw the PDF.”
Bank statements, HR packs, and customer CSVs are the obvious test. Bank statement to CSV and CSV editor exist so those files never become a vendor’s object. The walkthrough is convert a statement without uploading.
Article 5(1)(c) as an HTTP fact
Necessity is easy to test: open Network, convert, look for the file. If it is absent, you did not collect that personal data. If it is present, your policy is downstream of a design failure. The lab procedure is written out in the Network-tab guide.
Hashing and SRI are the same fact for binaries that are not “personal” in the GDPR sense but still confidential source. Web Crypto hashing is minimization for secrets.
CCPA sale and share
Selling or sharing personal information for cross-context advertising is a statutory concept. Page-level ads are not a license to attach file payloads to bid requests. The AMP ad unit on this site loads in a slot; it does not read the FileList. If a tool concatenated a statement into a tracking pixel, that would be a product bug, not “just ads.”
Retention versus RAM
ArrayBuffers are eligible for GC when the tab closes. Object storage is not. Downloads in the user’s folder are the user’s copies. Do not keep a shadow copy “for support.” Zero-server architecture is the threat-model sibling of this legal argument.
Photos, PDFs, and EXIF
Minimization for images includes not collecting GPS. Re-encode on canvas (Canvas processing) or strip EXIF. For PDFs, merge does not equal redact. Hidden text is still personal data if you transmit it.
A checklist for any free tool
Secure context, no multipart of the file, no third-party convert API, honest ads, no account required for the bytes. Then run the Network-tab procedure. If the vendor needs the file “to render a preview,” they needed a canvas, not your S3.
Worked example: month-end finance pack
Statements: bank statement to CSV as in the statement guide. Contracts: merge / redact. Receipt photos: strip EXIF then compress. Each step is a local Blob. The legal name is minimization; the test is Network tab.
If a vendor requires a portal upload, that is a processor with a purpose. A random converter is not. Why cloud utilities leak telemetry is the incident write-up. Do not “quickly merge” on a site you found by ads.
Hashes of the exported CSV can live in your ticket (SHA-256) so you know which file you emailed. That hash is not personal data in the same way the CSV is. The CSV should not have gone to a hash SaaS either — Web Crypto.
Ads on our pages must not include the file. If you ever see the statement size in a request, stop and report it. Architecture is only as good as the wiring.
Frequently asked questions
Is the browser a GDPR processor?
The user’s device executing JavaScript you shipped is not the same as you receiving a copy. You still have obligations for the site shell (logs, ads). The file bytes are the point of this article.
Do ads on a tool page count as selling the file?
Not if the file never leaves the tab. Ads must not receive the File or textarea. That is a wiring rule. Confirm with DevTools.
Does “we delete uploads in 24 hours” satisfy minimization?
Deletion is retention. Minimization is not collecting. A 24-hour S3 object is still a copy you had no need to take. Prefer merge PDF in-tab over any timed-delete API.