The Gap Between the HAR File and the GDPR Article
The gap between the HAR file and the GDPR article. A systemic problem no one calls by its name.
The violations are visible. They’re not hidden. They’re not encrypted. They don’t require secret access or insider information. They sit right there in the open network logs of any browser. Everything is written down. Who received the data. Exactly when — down to the millisecond. How many requests. Which identifiers flew off to someone else’s servers. Whether there was any consent at all — or whether the page was still loading when the data had already left.
But there are no cases. Companies keep operating. Brokers keep collecting. Government sites transmit citizens’ data to the US through undeclared processors — and there isn’t a single order to fix it. Not a single fine. Not a single demand for correction.
Not because the law is bad. The GDPR is a good law. One of the best digital-rights protection tools that exists in the world. Not because the regulator is inactive. Regulators exist, they accept complaints, they issue decisions.
Because between the fact of a violation and its legal classification, there’s a chasm. And no one is systematically building a bridge across it.
That’s the root of the problem.
Three worlds that don’t talk to each other
There are three professional worlds around the topic of personal data. Lawyers. Technical people. Regulators. All three worlds exist. All three deal with the same topic. All three speak different languages — and barely hear each other.
This isn’t a metaphor. It’s a literal situation that repeats itself, over and over, in every single data-protection case.
World one. The lawyer.
A data-protection lawyer knows the law. Knows it well. Has read the GDPR from Article 1 to Article 99. Knows the precedents — Planet49, Breyer, Schrems II. Understands the difference between a controller and a processor, between consent and legitimate interest, between a legal basis and its absence.
When a client brings them a complaint, the lawyer formulates it correctly. Cites the relevant articles. Quotes the privacy policy. Describes the violation in terms the regulator will understand.
But they don’t open a browser. They don’t record a HAR file. They don’t know what Canvas API fingerprinting is. They don’t understand why a request firing +12 milliseconds before the consent banner appears is already a violation of Article 6(1), not a technical nuance. They don’t see that Quantcast fired at +0 ms — before any user interaction — and that this is a documented fact of data transmission with no legal basis.
They know a violation occurred — if someone tells them about it. But they don’t see it themselves. Because to see it, you need to be looking somewhere else.
The lawyer looks at the text. The technical people look at the log.
World two. The technical person.
A developer or DevOps specialist who works with web infrastructure sees what the lawyer never sees. They open DevTools and, in two minutes, understand the architecture of any site. Which scripts load. From where. In what order. What exactly gets transmitted in the request parameters. Which identifiers are stored in localStorage. Who initiated the loading of the next tracker.
To them, a HAR file isn’t a scary document. It’s just a network log. Reads like a book.
But they don’t know that the CJEU ruling in Breyer C-582/14 means an IP address is personal data. They don’t know that Planet49 settled the question of pre-checked boxes back in 2019. They don’t know that transferring data to the US after Schrems II requires not just SCCs, but SCCs plus supplementary measures. They don’t know the difference between Article 13 and Article 14. They don’t know how to write a complaint that AKI [the Estonian DPA] will accept as a properly formatted submission.
They see the violation. See it clearly. But can’t name it in legal language. And so — for the system — their observation doesn’t exist.
World three. The regulator.
A data protection authority — in Estonia, that’s AKI; in Ireland, the DPC; in France, the CNIL — receives complaints from citizens. And does what it can with them.
The problem is that most complaints they receive are written either by lawyers with no technical evidentiary base, or by ordinary people who know something is wrong but can’t substantiate it.
A complaint written by a lawyer sounds convincing. But it has no +12ms timing in it. No screenshot of Application → Cookies showing that _fbp was set before any button was clicked. No IP address of the US server the request at page-start went to. It has a quote from a privacy policy and a citation to Article 6(1). That’s good. But it’s often not enough.
The regulator asks the company for an explanation. The company sends a response drafted by its legal department. The response states that all data is processed lawfully, that consent was properly obtained, that third parties are certified processors. Without technical expertise, the regulator can’t refute this. The case closes.
A complaint written by an ordinary person is even harder. The person wrote that “the site is tracking me.” The regulator can’t open an investigation on that basis. No facts. No evidence. No legal classification of the violation.
The result — the violation is documented in a HAR file. The violation is legally real. But within the system, it doesn’t exist.
That’s the chasm.
On one side — a technical fact. On the other — a legal document. Between them — nothing. No professional discipline that knows how to do both at once.
And companies know this. Know it very well. That’s exactly why a large company’s legal department is always a department. With people. With resources. With experience. While the person filing a complaint is one individual. Without tools. Without the language. Without understanding how the technology they’re trying to challenge actually works.
The asymmetry is deliberate. Deliberately maintained.
What happens in practice. A government site as an example
Let’s break down a specific situation. Not an abstract one. A real picture that repeats across dozens of sites.
A government portal. Estonia, or Latvia, or Lithuania — doesn’t matter. A government agency’s website. It offers services to citizens. Possibly authentication via eID. Possibly a form with personal data. Possibly information about vulnerable groups — the unemployed, welfare recipients, victims of violence.
This site has Google Tag Manager installed. Through GTM, Google Analytics 4 loads, tied to that specific agency’s account. Hotjar or Microsoft Clarity may load too — session-recording tools that literally record video of every mouse movement a user makes. Cloudflare Real User Monitoring may also fire, sending technical session data to Cloudflare’s American servers.
All of this fires at +0 milliseconds. At the very start of the page. Before the consent banner appears. Before any user interaction with the site at all.
This isn’t a hypothesis. It’s what’s visible in the HAR file, down to the millisecond.
Now the question. Is this a violation?
From a technical standpoint — obviously, yes. The data went out before consent. The recipient is an American company. There is, in fact, no legal basis.
From a legal standpoint — also yes. Article 6(1) of the GDPR — processing is lawful only where a legal basis exists. Article 5(1)(a) — the principle of lawfulness and transparency. Article 13(1)(e) — the data subject must know all recipients of their data. Chapter V — transfers to third countries require an appropriate mechanism.
But who’s going to say this to the regulator? In the right format. With the right evidence. With the right citations to the right articles.
A lawyer specializing in public law doesn’t know what GTM is or how it triggers the loading of third-party scripts.
A technical person who works with web infrastructure doesn’t know Chapter V of the GDPR or what an adequacy decision is.
An ordinary citizen knows neither. They just notice the ads seem oddly precise. Or that data about their visit to the government site somehow correlates with their behavior elsewhere. Or, most often, they don’t notice anything at all — because everything happens invisibly.
Why this gap exists. Systemic causes
The gap between the HAR file and the GDPR article. A systemic problem no one calls by its name.
The full truth is more complicated.
Cause one. Law systemically lags behind technology.
The GDPR was adopted in 2018. It’s a good law — but it was written by people who, for the most part, have no technical education. They described the problem in the language of law. Consent. Legal basis. Data recipients. Purposes of processing.
These are correct concepts. But the technology they were trying to regulate works differently. Technology doesn’t think in categories of “consent” and “purpose.” Technology thinks in categories of request and response. Initiator and recipient. Timings and identifiers.
When a lawyer reads Article 6(1) of the GDPR, they see a norm. When a developer looks at a +12ms timing in a HAR file, they see a fact. These aren’t the same thing. But they describe the same violation.
No one has written a translation dictionary between these two languages. There’s no standard methodology for exactly how a technical fact from a HAR file gets classified under a specific GDPR article. Everyone who does this reinvents the wheel from scratch.
Cause two. The industry invests in the asymmetry.
Large tech companies spend enormous sums keeping this asymmetry in place. Not directly — they don’t pay someone to keep lawyers from learning technology. Indirectly — through the complexity of their systems, through convoluted documentation, through architectural choices deliberately designed to obscure the real data flows.
An example. A major advertising broker’s privacy policy is a forty-page document. It says “we may share data with our partners to improve our services.” A lawyer sees a vague phrase. A technical person sees that “partners” means 847 companies on the TCF vendor list, participating in RTB auctions every 100 milliseconds. That’s not the same thing.
The company knows this. And it writes “partners” rather than a list of 847 companies — precisely because a list of 847 companies would force it to obtain 847 separate legal bases. “Partners” is a legal abstraction that conceals a technical reality.
Cause three. Regulators operate under a shortage of technical expertise.
Europe’s supervisory authorities — AKI in Estonia, the DPC in Ireland, the CNIL in France — are government bodies. They work with limited budgets. They compete for technical specialists against the private sector, where the same specialists earn several times more.
The result. The regulator receives a complaint. The complaint cites a violation. The regulator requests an explanation from the company. The company sends a technical response drafted by a team of five engineers and three lawyers. The regulator has to assess that response.
If there’s no one at the regulator who understands the difference between a third-party cookie and a localStorage identifier, assessment is impossible. The company says everything’s in order. There’s no tool to check that claim. The case closes.
Ireland’s DPC has faced years of criticism for slow handling of cases against Meta, Google, and other American companies whose European headquarters sit in Ireland. One of the genuine reasons is exactly this technical one. Proving a violation to the standard needed for a fine of billions of euros requires technical expertise the regulator simply lacks the manpower for.
Cause four. There’s no profession that does both.
The gap between the HAR file and the GDPR article. A systemic problem no one calls by its name.
Data Protection Officers exist. In theory, they’re supposed to bridge legal and technical understanding. In practice, most DPOs come either from the legal profession or from IT. The former write policies well. The latter configure systems well. Few know how to open a HAR file, find a violation, and write a complaint the regulator will accept.
Educational programs specifically training people for this intersection are practically nonexistent. There are legal data-protection programs. There are technical information-security programs. There’s no program that teaches you to read a network log and classify its contents under GDPR articles.
The person who can do both is very expensive on the market. Companies pay such people to help them avoid violations, or to make violations less obvious. To defend the company against complaints — not to file complaints.
What it means to read a HAR file as a legal document
There’s a specific thing a person capable of working at this intersection of technology and law does. They open a HAR file — and they don’t see a technical log. They see a millisecond-precise chronology of violations.
This isn’t a metaphor. Let’s break down how it works.
HAR — HTTP Archive. It’s the standard format for recording a browser’s network requests. Any browser can record it. You open DevTools. The Network tab. Check “Preserve log.” Open the site in incognito mode — so there’s no cache or old cookies. Wait 30-60 seconds. Navigate to one or two internal pages. Save the log.
The result — a file. It records absolutely everything that happened on the network during the session. Every request. With exact timing. With the HTTP status. With request and response headers. With the request body, if there was one. With the server’s IP address.
For a technical person, this is an ordinary tool. For a lawyer, it’s an unfamiliar format.
But this file is the entire evidentiary base.
Timing is a legal basis.
When the HAR file shows that a request to Google Analytics fired at +0 milliseconds from the start of the page, that’s not a technical fact. It’s a legal fact. It means Google Analytics launched before the user ever saw the consent banner. Before the banner was even loaded. Before any interaction at all.
This is a direct violation of Article 6(1) of the GDPR — data is being processed with no legal basis. Consent hasn’t been given. Legitimate interest doesn’t suffice for this type of processing. Other bases don’t apply.
+0 milliseconds. It’s a number. Specific. Documented. It’s not “possibly,” not “apparently.” It’s a fact recorded in the file with a precision no legal argument can refute.
A company can write, in response to a complaint, that “data is processed on the basis of consent.” But the HAR file shows processing began N seconds before the consent banner was even loaded. That’s called evidence. Simple. Verifiable. Reproducible.
The HTTP status confirms an actual transfer.
Not every request is the same. The HTTP status says exactly what happened.
200 or 204 — data was actually transmitted. The server received the request, processed it, responded. The transfer took place.
304 — a cached response. The request was sent — headers were transmitted, the user’s IP was visible to the server — but the response body came from cache.
0 — the browser blocked the response. But the request was initiated. That’s an attempt worth documenting.
These aren’t technical details. This is an evidentiary difference. A status of 200 means a confirmed data transfer. A status of 0 means an attempt — also significant for documenting the site’s behavior pattern.
When you write a complaint to a regulator stating that “a request to Quantcast fired at +347ms with status 200,” it means an actual data transfer is confirmed. Before consent. To an undeclared recipient. That’s three violations in one line.
The Set-Cookie header is a personal number assigned to the user.
When a server responds to a request and the response includes a Set-Cookie header, the browser saves a cookie. A small file containing an identifier. Unique. Specifically for this user. Specifically for this site or ad network.
The HAR file shows which cookies were set. By which domains. With what lifespan. Established before or after consent.
_fbp is the Facebook Pixel cookie. Set. Before the “accept” button was clicked. Lifespan — 90 days. Domain — .facebook.com. The site’s privacy policy doesn’t mention Facebook.
This is Article 13(1)(e) — the data subject wasn’t informed of the recipient. This is Article 6(1) — there’s no legal basis for the processing. This is Chapter V — Facebook is an American company, a transfer without an appropriate mechanism.
One line in a HAR file. Three GDPR articles. That’s what a person working at the intersection of technology and law can do.
The initiator is the chain of accountability.
In DevTools, every request has an “initiator” field — who triggered it. This answers the question, “how did this get here.”
For example. The site loads Google Tag Manager. GTM loads a Hotjar script. Hotjar loads its own session-recording server. That’s a chain. In the HAR file, it’s visible through the _initiator.stack field — the call stack that led to that specific request.
The legal significance of this chain is Article 28(2) of the GDPR. A processor cannot engage a sub-processor without the controller’s prior authorization. Every node in the chain must be documented in a data-processing agreement.
When the chain “GTM → Hotjar → server in the US” isn’t documented in the site’s privacy policy, that’s a violation. When it isn’t documented in the agreement between the site and Hotjar, that’s also a violation. The technical person sees the chain in the HAR. The lawyer knows which article it violates. The person working at the intersection turns it into a complaint.
Government sites. Where the stakes are higher
The gap between the HAR file and the GDPR article. A systemic problem no one calls by its name.
A commercial site sending data to an ad broker is a problem. Bad. Unlawful. In need of correction.
A government healthcare site sending visitor data to Google Analytics is a different level entirely. A person who visited a page about cancer treatment, or about support for domestic violence victims, never consented to Google knowing they were on that site. This is health data. Article 9 of the GDPR — a special category. Maximum protection. Processing prohibited without explicit consent.
A government site with eID authentication is trickier still. In a session where a citizen logs in using their national ID, undeclared American processors are running. This isn’t just a privacy-rights violation. It’s a potential risk of leaking information about the fact that a specific citizen, with a specific ID, used a specific government service. In certain contexts, that’s information about political activity, legal status, or family circumstances.
The GDPR was built, among other things, precisely for situations like this. Article 9 — special categories. Article 22 — automated decisions. Chapter V — international transfer. All of these are protective tools built for exactly this kind of situation.
But to apply these tools, you first have to establish the fact. Open the HAR file. Find the request at +0ms. Look at the status — 200. Look at the IP address — it’s American. Check the privacy policy — this recipient isn’t there. Write a complaint with precise data.
That’s a chain of actions requiring two competencies at once. Technical — to find it. Legal — to classify it.
A comparison against the standard
Why “technically impossible” is a lie
When a company or government agency responds to a complaint, one of the most common arguments goes like this: “We use standard tools. Otherwise, the site can’t function. This is technically necessary.”
That’s a lie. A documented one.
Sites exist that operate without a single external tracker. Without data transfers to the US. Without undeclared recipients. With real GDPR compliance — not declarative, but technical.
eesti.ee — Estonia’s government portal — 0 external domains. A strict Content Security Policy that genuinely blocks third-party scripts. The whitelist contains only *.ria.ee and *.eesti.ee. Not a single request to Google. Not a single Facebook Pixel. Not a single advertising broker.
riigihanked.riik.ee — Estonia’s public procurement registry — a similar picture. 0 external trackers. The CSP genuinely blocks.
edpb.europa.eu — the site of the European Data Protection Board, Europe’s highest supervisory body — about 49 requests. 0 trackers. This is the body that writes GDPR compliance guidance. And its own site meets the standard it writes about.
This is proof. Simple and irrefutable. If eesti.ee works without Google Analytics, then a functioning site without Google Analytics is possible. If the public procurement portal works without Hotjar, then recording a citizen’s every mouse movement is not, in fact, a technical necessity.
“Technically impossible” isn’t an argument. It’s a position that a single URL can easily disprove.
That’s exactly why every site review includes a comparison against these standards. Not as a rhetorical flourish. As a methodological necessity. Proof that compliance is possible is part of the proof that non-compliance is a choice.
A choice that carries legal accountability.
How one person changes the equation
There’s a story worth telling. Not in the abstract — specifically.
Gonzalo Fuentes — a Spaniard. Not a lawyer. Not a technical data specialist. He discovered that Google’s search results showed an old article about debts of his that had long since been paid off. He filed a complaint with the Spanish regulator. The case reached the CJEU. The result — Google was required to remove links to outdated information upon request from EU citizens. This became the right to be forgotten. Article 17 of the GDPR. One person changed how search works for 450 million Europeans.
Not a lawyer. Not a technical specialist. Just a person who noticed a violation and didn’t give up.
But imagine if he’d had a HAR file. And knew what to do with it.
This isn’t rhetoric. It’s a real question about how the story might have unfolded differently if, at the intersection of technical expertise and legal knowledge, there stood not one random individual — but a systematic practice.
What a properly drafted complaint looks like
A complaint to AKI — or any European supervisory authority — isn’t a “complaint” in the everyday sense of the word. It’s a legal document. It must contain specific facts. Specific articles. Specific evidence.
A bad complaint looks like this: “Site X violates my rights. It has some trackers. This is illegal.” The regulator receives it. Sends a request to the company. The company responds that everything’s lawful. The case closes.
A good complaint looks like this.
Date. Time. Site opened in incognito mode. Page loaded.
At +0 milliseconds from the start of the page — before the consent banner appeared — a request to the domain quantserve.com (Quantcast) was recorded with HTTP status 200. The server’s IP address — [specific address] — belongs to Quantcast Inc., US. The response to the request set a cookie, __qca, with a lifespan through [date]. Quantcast is not mentioned in the site’s privacy policy.
At +12 milliseconds — a request to googletagmanager.com with status 200. Google Tag Manager loads Google Analytics 4 code with identifier [specific GA4 ID]. The privacy policy mentions Google Analytics as an analytics tool. No mechanism for transferring data to the US is specified.
The consent banner appeared at +1847 milliseconds. By the time the banner appeared, [N] external domains had already received visit data.
The site’s privacy policy states that data is “not transferred outside the EU.” The HAR file recorded requests to US servers [N] milliseconds before the banner appeared.
Documented violations.
Article 6(1) of the GDPR — data processing was initiated before consent was obtained and with no other lawful basis. [List of recipients with timings.]
Article 5(1)(a) — the principle of lawfulness and transparency was violated. The privacy policy contains a statement of no data transfer outside the EU, which is contradicted by documented requests to American servers.
Article 13(1)(e) — the data subject was not informed of the following recipients of their data: [list of services actually in operation, absent from the policy].
GDPR Chapter V — data is transferred to the US with no transfer mechanism specified (SCCs, an adequacy decision, or otherwise).
Attached to the complaint: a HAR file recorded on [date and time], screenshots of Application → Cookies showing set identifiers, screenshots of the developer console, quotes from the privacy policy with its publication date.
This is a document. This is an evidentiary base. This is something a regulator can work with.
The difference between the first complaint and the second isn’t that the violations differ. The violations are the same. The difference is that the second complaint has facts. Numbers. Timings. Articles. Evidence.
And that difference is created precisely by the intersection so sorely missing from the system.
Why companies fear precisely this intersection
The gap between the HAR file and the GDPR article. A systemic problem no one calls by its name.
The first complaint gets handled with a standard legal-department response. “We process data lawfully. Consent was properly obtained. Our processors comply with GDPR requirements.” Without specific facts, there’s nothing to refute. The regulator notes the response and moves on.
The second complaint is a different story. It states that at +347 milliseconds from the start of the page, before any user interaction, data went out to Quantcast — a company not mentioned in the privacy policy — with HTTP status 200, to the American IP address 151.101.X.X, and that an identifier, __qca, with a 13-month lifespan, was set in the browser.
“We process data lawfully” doesn’t answer that. Because the complaint contains a specific fact that can be verified. The regulator can open the same site themselves and reproduce the same recording. The company has to explain exactly that specific request at exactly that specific millisecond. And the legal basis for it, specifically.
This is inconvenient. It requires real explanations. It forces the company to either fix the violation or explain why it isn’t one — which, in most cases, is impossible.
That’s precisely why the system is built so this intersection doesn’t exist. So lawyers don’t know the technology. So technical people don’t know the law. So ordinary citizens know neither.
The system is designed on the assumption that no one will show up with a HAR file and the right articles at the same time.
What changes when this intersection appears
This isn’t a theoretical question. It’s a question of practice.
Every complaint filed with a technical evidentiary base and correct legal classification creates a precedent. Not necessarily a public one. Sometimes it’s enough that the company fixed the violation after the request — that’s already a change in practice.
When a single HAR-based complaint shows Quantcast operating on ten government sites with no disclosure in the policy, that’s a pattern. That’s a systemic problem. That’s grounds for a regulator not just to respond to one complaint, but to launch a review of the entire category of sites.
When a review of one site gets published and becomes visible, operators of similar sites get a signal. They see that someone’s watching. That HAR files are being opened. That the gap between declaration and reality is being documented publicly. That changes their risk calculus.
It’s slow. It’s not a revolution. But this is how systemic change happens in a legal environment. One documented case. Then another. Then enough of them accumulate for the regulator to see a pattern. For journalists to write about it. For the agency responsible for the sites to face political pressure to fix things.
About specialists who don’t exist. And why they don’t
Let’s return to the original question. Why are there so few digital-field specialists who can connect a HAR file to the right article.
A partial answer has already been given. Education is siloed. The industry invests in the asymmetry. Regulators operate under resource shortages.
But there’s one more reason, less often named.
People who work at this intersection are working against the system. That’s important to understand literally.
A technical person who knows the technology well is in demand. Large companies pay well for DevOps, for security, for web development. That money comes from companies interested in collecting data efficiently. Not in collecting it lawfully. These two interests diverge.
A lawyer who knows the GDPR well is in demand. Companies pay for DPOs who write privacy policies and help avoid fines. That’s a different task from “find the violation and document it.” It’s the task of “write documents that look correct.”
The person who can do both — and uses it to file complaints and publish public reviews — operates outside the system of incentives that normally shapes careers. Their work doesn’t monetize through standard channels. Companies don’t pay them for what they do — they’d rather this person weren’t doing it at all.
This doesn’t mean this kind of work doesn’t exist. It means it’s done either out of principle, or because it became a personal cause, or because a particular combination of circumstances made it possible.
A practice that creates precedents
20 active cases against advertising brokers isn’t an abstraction. These are specific complaints. Specific responses. Specific documented violations.
Every case is a HAR file. Timings. IP addresses. Quotes from privacy policies. GDPR articles with precise citations to specific violations.
Most companies, on receiving such a complaint, react in one of three ways.
The first — they stay silent. Quantcast didn’t respond within the required 30-day period. That itself is a violation of Article 12(3) of the GDPR. And it too is documented. Date of the request. Date the deadline expired. The fact of no response. That’s enough grounds for a complaint to the regulator on this specific basis — regardless of the original violation.
The second — they send a boilerplate response. “We process data in accordance with applicable law.” Without answering the specific questions asked. Without explaining the specific facts from the HAR file. This too is a violation — Article 12 requires that a response actually address the substance of the request.
The third — they fix it. Rarer. But it happens. The company understands the specific facts are documented and it has no convincing explanation. It’s easier to fix things than to keep arguing over something already on record.
Each of these outcomes is data. For the regulator. For the next complaint. For understanding how the system works.
Reviewing government sites is a genre of its own. The motivation here is different. A government site is required to comply with the law not out of fear of a fine — but because the state itself is the body meant to enforce that same law. When a government site transmits citizens’ data to Google without consent, that’s not just a GDPR violation. It’s a demonstration that the state doesn’t believe in the very standards it applies to private companies.
This is political. And a public review with specific numbers is a political tool. Not in the sense of partisan politics. In the sense of public accountability.
What “behavioral consistency” means as a defense
There’s an idea that closes out one of the earlier pieces. About systems like Palantir. About how they don’t fear a developed conscience — they fear an organized, developed conscience. And how the only truly unassailable position is behavioral consistency. When there’s no gap between what you think, what you say, and what you do.
This applies directly to the topic of HAR files and the GDPR too.
A person who publicly documents violations — and who themselves meets the same standards they’re checking others against — stands in a position that’s hard to attack. No gap. No double standard. No opening for discrediting them.
This matters not just as an ethical stance. It matters methodologically. If you’re auditing government sites for undeclared trackers, and you yourself use Google Analytics without proper documentation, your argument is weakened. Not legally — but publicly.
Consistency builds trust. Trust builds influence. Influence drives change.
Documentation as the system’s memory
The system is built to wear you down. We talked about this in the context of Privacy Fatigue. But fatigue isn’t just a consumer problem. It’s a problem for the people documenting violations too.
A case is opened. The company doesn’t respond. You wait a month. You file a complaint with the regulator. The regulator asks for additional materials. You send them. The regulator reviews. Months pass. The company sends an explanation. The regulator evaluates it. It asks you to respond to the company’s explanation. You respond. Several more months pass.
This is a marathon. Not a sprint.
That’s exactly why documentation isn’t just a formality. It’s the tool that makes it possible to hold up through the marathon. When every step is recorded. When every date is written down. When every response is saved. When the HAR file just sits there and doesn’t vanish — unlike your memory of what a site looked like six months ago.
Documentation is the system’s memory — the memory the system would rather erase.
Why this matters beyond specific cases
There’s a broader context.
Data about people is power. Not metaphorically. Literally. Whoever knows everything about you can make decisions about you. About credit. About insurance. About being hired. About whether you’ll see this piece of news or not. About whether the algorithm shows you this political message or that one.
This is power that isn’t elected. Isn’t accountable. Isn’t limited by a term of office. It simply exists — for as long as the data exists. And data exists for a very long time.
The GDPR is an attempt to create a balance. A tool that gives a person rights over data about themselves. The right to know. The right to correct. The right to erase. The right to object.
But a tool only works when it’s used. And used correctly. With an evidentiary base. With a legal classification. With an understanding of exactly what’s happening on the network while a page is loading.
The gap between the HAR file and the GDPR article isn’t just a professional problem. It’s a political problem. A problem of the balance of power. As long as this gap exists, the power that comes from data stays with those who have both technical people and lawyers at once. With the large companies. With those who can afford both.
Every person who can work at this intersection restores that balance a little. Not fully. But by the amount one person is capable of changing.
History shows that’s often enough.
One Spaniard who noticed an article about paid-off debts changed how search works for 450 million Europeans.
One Austrian activist who complained about the use of Google Analytics changed web-analytics standards across Europe.
A handful of people who documented that Clearview AI was collecting biometric data without consent became part of a wave of complaints that brought the company fines in seven countries.
None of them was a lawyer with a team behind them. None was a technical specialist with access to the company’s internal systems.
They simply noticed a violation. Documented it. Filed a complaint. And didn’t give up when it got hard.
The system counts on exhaustion. On the person giving up. On the assumption that, without specialized knowledge — both legal and technical at once — it’s impossible to see it through to the end.
The gap between the HAR file and the GDPR article is exactly the exhaustion the system deliberately produces. A complexity that filters people out. A barrier most never get past.
But the barrier doesn’t exist because it’s impossible. It exists because most people don’t know it can be overcome.