Strengthened GDPR: WebAcappella Complies with Europe's Strictest Requirements

On paper, the GDPR is a single regulation for the entire European Union. In practice, however, each country interprets it in its own way—and Germany has a well-deserved reputation for applying the strictest interpretation. A website that is fully compliant by French standards may be deemed non-compliant by a court or data protection authority in Germany. If your website targets German visitors—or Austrian visitors, since Austria follows an equally strict approach—the bar is set higher.

It is precisely because of these stringent requirements that the 4.0.19 update to WebAcappella Fusion (July 14, 2026) introduces three new features: a strict mode for the cookie banner, click-to-play videos, and click-to-play third-party content in the HTML component. Three options, zero lines of code, and a site that no longer contacts any third-party services without the visitor’s explicit consent.

Why Is Germany More Stringent?

In Germany, the GDPR (DSGVO in German) is supplemented by a national law dedicated to digital services, and above all by particularly strict case law. The best-known case remains that of Google Fonts: in 2022, a Munich court ruled against a website operator simply because its pages loaded fonts from Google’s servers—in the process transmitting the visitor’s IP address without their consent.

The German approach can be summarized as follows: as long as the visitor has not given consent, their browser must not contact any third-party services. No requests to Google, no connection to YouTube, no external widgets. This is more stringent than current practice in France, where oversight focuses primarily on cookies and trackers that are actually set—simply loading a third-party resource has not, to date, resulted in similar convictions there.

New Feature 1 — Strict Mode for the Cookie Banner

Until now, WebAcappella Fusion relied on Google’s Consent Mode: Google Analytics or Tag Manager scripts were loaded as soon as the page was accessed, but remained “restricted”—no cookies, no identifiers—until the visitor gave consent. This is the approach recommended by Google, and it remains widely accepted in France.

The problem? Even when restricted, the script is loaded: the visitor’s browser contacts Google’s servers before any consent is given. This is exactly what a strict interpretation of the GDPR prohibits. The new strict mode addresses the issue at its root:

• Before consent: no requests are sent to Google. Nothing is loaded—neither Analytics nor Tag Manager.
• After acceptance: the scripts load normally, and analytics work as usual.
• In case of refusal: nothing is ever loaded. The visitor browses without any Google services being accessed.

The option is located in Site Properties → Third-Party Services. If your audience is primarily French, the default “Consent Mode” behavior remains appropriate (it preserves Google’s aggregated statistics, among other things). If you’re targeting Germany or prefer to err on the side of caution, enable strict mode.

New Feature 2 — Click-to-load videos (front page)

Embedding a YouTube, Vimeo, or Dailymotion video is convenient—but as soon as the page loads, the embedded player connects to the provider and may set third-party cookies, even before the visitor has started playback. Here again, a strict interpretation of the GDPR sees this as a problem.

The new global option “Load videos on click” (site properties → Third-party services) replaces each video with a placeholder: a neutral preview with a Play button. As long as the visitor doesn’t click, their browser doesn’t establish any connection with the video provider—so no third-party cookies are set. When clicked, playback starts immediately.

New Feature 3 — Third-Party Content via the HTML Component, on Click

WebAcappella Fusion’s HTML component is often used to integrate external widgets: an Elfsight review module, a Calendly booking calendar, a social media feed… All of these services are also contacted as soon as the page is displayed.

A new checkbox “Load only after a click (third-party content / GDPR)” has been added to the HTML component’s properties. When enabled, it applies the same principle as for videos: on the published site, the widget is replaced by a neutral placeholder and only loads when the visitor clicks on it. No requests are sent to the third-party service, and no cookies are set, until this explicit action has taken place—without the need for an additional consent tool.

Plus: Truly Explicit Consent

This update also corrects a detail that is actually quite significant: in the “Customize” view of the cookie banner, the Statistics checkbox was pre-checked on the first visit. However, European case law has been clear since the Planet49 ruling: a pre-checked box does not constitute consent. It is now unchecked by default—the visitor’s saved choice is, of course, still displayed during subsequent visits.

How to enable all of this on your site

1. Update WebAcappella Fusion to version 4.0.19 or higher.
2. Open the site properties, then the Third-Party Services section.
3. Enable Strict Mode for the cookie banner if you’re aiming for maximum compliance (Germany in particular).
4. Enable “Load videos on click” to turn your YouTube, Vimeo, and Dailymotion videos into thumbnails.
5. For each HTML component that includes an external widget, check “Load only after a click (third-party content / GDPR)” in its properties.
6. Republish your site: the new protections take effect immediately.

In summary

• Germany enforces the strictest interpretation of the GDPR: no contact with third-party services before consent is given.
• Strict mode loads Google scripts only after the visitor accepts—and never if they decline.
• Video wrappers block any connection to YouTube, Vimeo, or Dailymotion before a click, and speed up your pages.
• The HTML component can now delay the execution of third-party widgets (Elfsight, Calendly, social media, etc.) until the visitor clicks.
• The "Statistics" checkbox in the banner is unchecked by default, in accordance with European case law.
• Everything can be configured in just a few clicks in the site properties—no external tools, no code.

GDPR compliance is rarely the most exciting part of building a website. With these new options, it boils down to a few checkboxes—even for visitors from Europe’s most stringent countries.