Security Headers as Privacy Tools: CSP, HSTS, and Permissions-Policy

Security Headers as Proactive Privacy Controls

HTTP security headers are traditionally deployed to prevent XSS attacks and man-in-the-middle vulnerabilities. Their role as privacy enforcement mechanisms under GDPR Art. 25(1) (Privacy by Design) is often overlooked. Content Security Policy (CSP), HTTP Strict Transport Security (HSTS), and Permissions-Policy can technically prevent unauthorized data transfers, supporting accountability obligations under Art. 5(2) GDPR.

These headers function as technical safeguards operating at the HTTP protocol level—before JavaScript execution or third-party connections can be established.

Content Security Policy: Technical Control Over Data Flows

CSP defines permitted sources for various resource types via the Content-Security-Policy HTTP header. For privacy compliance, the connect-src and script-src directives are particularly critical.

A restrictive CSP configuration such as script-src 'self'; connect-src 'self' technically prevents loading of third-party tracking scripts and AJAX requests to external domains. This supports purpose limitation under GDPR Art. 5(1)(b) by excluding unintended data transfers to third parties.

Particularly relevant: The CSP report-uri directive automatically documents violations. These logs serve as technical evidence that no unauthorized connections to tracking services occurred—a crucial component for accountability obligations.

Practical CSP Implementation for Privacy

For GDPR-compliant websites, CSP should minimally include these directives:

• default-src 'self' – Generally only own resources
• script-src 'self' 'unsafe-inline' – Inline scripts only when unavoidable
• connect-src 'self' – No AJAX requests to third parties
• img-src 'self' data: – Prevents third-party tracking pixels

Exceptions for consent management systems or necessary third parties must be explicitly defined and documented.

HSTS: Protection of Sensitive Data Transmissions

The Strict-Transport-Security header enforces encrypted connections and prevents downgrade attacks. From a privacy perspective, HSTS protects personal data from interception during transmission—a technical measure under GDPR Art. 32(1)(a).

The configuration Strict-Transport-Security: max-age=31536000; includeSubDomains; preload provides:

• Year-long validity of HTTPS enforcement
• Protection of all subdomains
• Inclusion in browser preload lists

Particularly critical for form data: Without HSTS, session IDs and personal data can be transmitted in plaintext during downgrade attacks.

Permissions-Policy: Granular Control Over Browser APIs

The Permissions-Policy header (formerly Feature-Policy) controls access to browser APIs like geolocation, camera, or microphone. These APIs process particularly sensitive personal data under GDPR Art. 9.

A restrictive policy such as Permissions-Policy: geolocation=(), camera=(), microphone=() completely disables these APIs and prevents unintended access by third-party scripts.

For websites requiring these APIs, access should be restricted to the own domain: geolocation=(self), camera=(self).

Documentation Requirements and Legal Classification

Security header implementation must be documented under GDPR Art. 30. Essential elements include:

1. Configured header values and their privacy law justification
2. Third-party exceptions with corresponding DPA references
3. CSP report monitoring logs as compliance evidence
4. Regular review of header configuration

Technical Implementation and Monitoring

Security headers should be implemented both server-side and application-side. Nginx configuration:

add_header Content-Security-Policy "default-src 'self'; script-src 'self'"; add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; add_header Permissions-Policy "geolocation=(), camera=()";

For continuous monitoring, CSP reports should be sent to a dedicated endpoint and automatically analyzed. Violations of configured policies may indicate privacy breaches.

Regular review of header configuration using tools like securityheaders.com or observatory.mozilla.org forms part of technical and organizational measures under GDPR Art. 32.