Legal & Compliance

Website TLS, HTTPS, Mixed Content, and Privacy Security

GDPR Article 32 requires controllers and processors to implement technical and organizational measures appropriate to risk, including measures supporting confidentiality and integrity. It does not prescribe one universal TLS configuration for every service.

What AllyProof observes

The compliance check records whether the reviewed page uses HTTPS and whether an HTTPS page requests resources over HTTP. These are concrete browser-visible signals. It does not run a penetration test, validate every certificate path and cipher, inspect server-side storage, or certify Article 32 compliance.

Review and remediation

• redirect HTTP to HTTPS without leaving sensitive endpoints behind;
• remove or replace every insecure resource URL;
• keep TLS libraries and certificate automation current;
• use secure cookies and appropriate transport headers;
• test forms, APIs, downloads, and third-party assets; and
• document the risk assessment behind the chosen controls.

The German Federal Office for Information Security publishes current TLS technical guidance. Its configurations are useful engineering references, while the legal measure required for a particular organization still depends on risk and context.

Official sources

• GDPR, Article 32
• BSI Technical Guideline TR-02102-2 for TLS

Common questions

Does HTTPS make a website GDPR compliant?

No. HTTPS is an important transport safeguard, while GDPR security is risk-based and covers a much broader set of technical and organizational measures.

What is mixed content?

Mixed content occurs when an HTTPS page loads a subresource over insecure HTTP. Browsers may block active content, but insecure requests can still undermine confidentiality, integrity, or functionality.