Empirically Measuring Data Localization in the EU
Fuente:
arXiv
Salvato in:
| Autori principali: | , , , , , , |
|---|---|
| Natura: | Preprint |
| Pubblicazione: |
2025
|
| Soggetti: | |
| Accesso online: | |
| Tags: |
Aggiungi Tag
Nessun Tag, puoi essere il primo ad aggiungerne!!
|
| _version_ | 1866918071885627392 |
|---|---|
| author | Gamero-Garrido, Alexander Yu, Kicho Shankar, Sumukh Vasisht Singh, Sachin Kumar Balasubramanian, Sindhya Wilcox, Alexander Choffnes, David |
| author_facet | Gamero-Garrido, Alexander Yu, Kicho Shankar, Sumukh Vasisht Singh, Sachin Kumar Balasubramanian, Sindhya Wilcox, Alexander Choffnes, David |
| contents | EU data localization regulations limit data transfers to non-EU countries with the GDPR. However, BGP, DNS and other Internet protocols were not designed to enforce jurisdictional constraints, so implementing data localization is challenging. Despite initial research on the topic, little is known about if or how companies currently operate their server infrastructure to comply with the regulations. We close this knowledge gap by empirically measuring the extent to which servers and routers that process EU requests are located outside of the EU (and a handful of ``adequate'' non-EU countries). The key challenge is that both browser measurements (to infer relevant endpoints) and data-plane measurements (to infer relevant IP addresses) are needed, but no large-scale public infrastructure allows both. We build a novel methodology that combines BrightData (browser) and RIPE Atlas (data-plane) probes, with joint measurements from over 1,000 networks in 19 EU countries. We find that, on average, 2.3% of servers serving users in each EU country are located in non-adequate destination countries (1.4% of known trackers). Our findings suggest that data localization policies are largely being followed by content providers, though there are exceptions. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2504_09019 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | Empirically Measuring Data Localization in the EU Gamero-Garrido, Alexander Yu, Kicho Shankar, Sumukh Vasisht Singh, Sachin Kumar Balasubramanian, Sindhya Wilcox, Alexander Choffnes, David Networking and Internet Architecture EU data localization regulations limit data transfers to non-EU countries with the GDPR. However, BGP, DNS and other Internet protocols were not designed to enforce jurisdictional constraints, so implementing data localization is challenging. Despite initial research on the topic, little is known about if or how companies currently operate their server infrastructure to comply with the regulations. We close this knowledge gap by empirically measuring the extent to which servers and routers that process EU requests are located outside of the EU (and a handful of ``adequate'' non-EU countries). The key challenge is that both browser measurements (to infer relevant endpoints) and data-plane measurements (to infer relevant IP addresses) are needed, but no large-scale public infrastructure allows both. We build a novel methodology that combines BrightData (browser) and RIPE Atlas (data-plane) probes, with joint measurements from over 1,000 networks in 19 EU countries. We find that, on average, 2.3% of servers serving users in each EU country are located in non-adequate destination countries (1.4% of known trackers). Our findings suggest that data localization policies are largely being followed by content providers, though there are exceptions. |
| title | Empirically Measuring Data Localization in the EU |
| topic | Networking and Internet Architecture |
| url | https://arxiv.org/abs/2504.09019 |