Developer Guide
How to make a React app GDPR compliant
Client-rendered React apps often wire up third-party SDKs directly in components — a common source of pre-consent tracking.
Centralise consent state
Create a consent context and only initialise analytics/marketing SDKs after consent is granted.
Avoid PII in the URL and logs
Don't put emails or tokens in query strings or console logs — they leak into history and monitoring tools.
Proxy sensitive calls
Route calls that need secrets through your backend; never embed private keys in the bundle.
Implement user rights flows
Add UI and endpoints for data export and account deletion.
FAQs
Can I load Google Analytics in useEffect?
Only after the user consents. Check consent state before injecting the script.
Are localStorage tokens a GDPR problem?
They're more a security concern (XSS), which GDPR Art. 32 covers — prefer httpOnly cookies for sensitive tokens.