---
title: "Privacy, accessibility and CSP"
manual: "Klimadashboard"
version: "1.0"
permalink: "https://docs.typo3.org/permalink/klimadashboard/typo3-klimadashboard:privacy@1.0"
source: "Privacy/Index.rst"
rendered: "2026-10-29T18:09:19+00:00"
---

# Privacy, accessibility and CSP {#privacy}

## Privacy (DSGVO/GDPR) {#privacy-dsgvo-gdpr}

-   Neither the extension nor the embedded charts set cookies or track visitors.
-   The chart is loaded from klimadashboard.de/.at/.org (hosted in the EU). As
    with any embedded content, the visitor's browser transmits its IP address to
    Klimadashboard.
-   For sites that want consent first, enable **Load on click** per
    element or globally (`consent`). The chart is then only requested after the
    visitor clicks the button; the notice links to the privacy policy
    (`privacyUrl`).
-   The TYPO3 backend fetches the chart and region lists from the public
    Klimadashboard API server-side; no visitor or editor data is sent.

## Accessibility (WCAG 2.1 AA) {#accessibility-wcag-2-1-aa}

-   Each iframe gets the chart title as accessible name (`title`) and the
    chart's language (`lang`).
-   The charts provide text alternatives and a table view.
-   The click-to-load button is keyboard-operable and moves focus to the chart
    after loading; colours meet the AA contrast ratio.

## Content Security Policy {#content-security-policy}

On TYPO3 v12 and later, the extension adds `frame-src` for the configured
Klimadashboard hosts to the frontend policy
([`Configuration/ContentSecurityPolicies.php`](https://docs.typo3.org/m/typo3/reference-coreapi/14.3/en-us/ExtensionArchitecture/FileStructure/Configuration/ContentSecurityPolicies.html#file-extension-configuration-contentsecuritypolicies-php)). The resize script is a
local file, so `script-src 'self'` is sufficient. For TYPO3 v11 see
[Installation](https://docs.typo3.org/permalink/klimadashboard/typo3-klimadashboard:installation@1.0).