# Ship Europe First


## No Cookies. No Worries. {class=text-accented}

Europe's GDPR was a big {{< sparkle >}}boogeyman{{< /sparkle >}} – <a href="https://cms.law/en/int/publication/gdpr-enforcement-tracker-report/numbers-and-figures" class="link-subtle"><b>2,245 fines, €5.65 billion</b></a> – but at **Lightwaves** it was never really an issue: We build sites **without cookies**.
Users see messages instead of popups. But our benefits go deeper: you need no legal monitoring and no compliance updates.
When the next EU-US agreement falls apart, you lean back instead of towards your lawyer.
We don't just make websites **in** Europe, we make them **from** Europe.
No cookies **means true independence**. Lightwaves is EU-Native. By Design. You can soon test it yourself with our [EU Audit](/en/eu-audit).

<div class="audit-journey-card">
  <div class="audit-journey-header">
    <img src="/images/people/newsletter/communication-agency-lightwaves-avatar-rounded-christoph.png" alt="Christoph Kranebitter" class="audit-journey-avatar">
    <div class="audit-journey-meta">
      <div class="audit-journey-title">The Work for Freedom</div>
      <div class="audit-journey-note">Note from Christoph</div>
    </div>
  </div>
  <div class="audit-journey-desc">I've invested years in zero-cookies by now: Learning Kubernetes. Understanding Google Fonts. Months in CDNs. Writing my own form server. Adapting Plausible. 1000 decisions, all rooted in one: Let's be free. Sometimes I still use US cloud (Cloudflare mostly) – convenience, skill issues. But every Monday I sit down and try to get rid of another one.</div>
</div>

## Clouds your Judgement {class=text-accented}

And that's special. Because almost every website greets you today with a cookie banner that essentially screams "NOT INDEPENDENT". Why? The Cloud: Google Analytics. Google Fonts. YouTube embeds. Facebook Pixel. The standard stack of all agencies. [30% of all users](https://ignite.video/en/articles/basics/cookie-consent-studies) are bothered when their privacy isn't respected. That's why we host everything ourselves in the EU. We're probably the only agency in beautiful Austria that lives this consequence. The result: No banner. No third-party requests. No dependency.

## Deep Dive Consent {class=text-accented}

But cookies aren't the only thing that needs consent. Simply hosting your website with American companies is enough. Netlify, Vercel, and Cloudflare are currently legal to use – certified under the EU-US Data Privacy Framework (DPF). But:

| Framework | Duration | Fate |
|-----------|----------|------|
| <a href="https://en.wikipedia.org/wiki/International_Safe_Harbor_Privacy_Principles" class="link-subtle">Safe Harbor</a> | 2000–2015 | Invalidated (Schrems I) |
| <a href="https://en.wikipedia.org/wiki/EU–US_Privacy_Shield" class="link-subtle">Privacy Shield</a> | 2016–2020 | Invalidated (Schrems II) |
| Data Privacy Framework | 2023–? | Still running... |

The DPF is, as the table shows, the third agreement in the last 10 years. <a href="https://en.wikipedia.org/wiki/Max_Schrems" class="link-subtle">Max Schrems</a> [is already preparing the next lawsuit](https://www.jentis.com/blog/noyb-will-challenge-the-new-data-privacy-framework) – the Trump administration has already [rendered US privacy oversight inoperable](https://www.didomi.io/blog/eu-us-data-privacy-framework-dpf-2025). Anyone hosting on Netlify is betting that this time will be different. Google Analytics has already been [ruled illegal in six EU countries](https://usercentrics.com/knowledge-hub/google-analytics-and-gdpr-compliance-rulings/) – Austria, France, Italy, Netherlands, Denmark, Norway. GDPR fines since 2018? [€5.65 billion](https://www.enforcementtracker.com/).

Yes, AWS has an EU region. Yes, the DPF is currently valid. But sovereignty isn't about where the server sits – it's about who can knock on the door. The [CLOUD Act](https://en.wikipedia.org/wiki/CLOUD_Act) – a 2018 US law – allows US authorities to access data from any US company. Worldwide. Regardless of server location.

<picture>
  <source media="(orientation: portrait)" srcset="/images/news/ship-europe-first/pacman-chase-portrait.svg">
  <img src="/images/news/ship-europe-first/pacman-chase.svg" alt="EU Pacman chases US companies" loading="lazy">
</picture>

## EU-Native {class=text-accented}

Europe sings Ode to Joy. Digitally, we hide behind the Star-Spangled Banner.
[91% of German companies](https://medianet.at/news/marketing-and-media/charta-zur-digitalen-souveraenitaet-70248.html) are dependent on US digital imports. [72% of the EU cloud market](https://www.telecoms.com/public-cloud/european-cloud-players-face-declining-market-share-as-us-hyperscalers-clean-up) belongs to AWS, Azure, and Google. The [Digital Summit in Berlin](https://orf.at/stories/3403938/) is now calling for a rethink. Digital Sovereignty should be in our DNA. We have a supranation – let's carry that supra into our products.
Not because US hosting is illegal. But because independence is simpler:

- **No frameworks needed**
- **No DPF monitoring**
- **No panicked migrations**
- **Privacy as a selling point**
- **No cookie banner**
- **True independence**

If Roland Barthes had internet, he would say, "The death of dependency is the birth of the user." His countryman says it like this:

> »Europe doesn't want to be the client of the big entrepreneurs or the big solutions being provided either from the US or from China. We clearly want to design our own solutions. A refusal of being a vassal.«
>
> <cite>Emmanuel Macron, Digital Summit Berlin 2025[^macron]</cite>

We're not alone. [Hetzner](https://www.hetzner.com/), [OVHcloud](https://www.ovhcloud.com/), [Scaleway](https://www.scaleway.com/) – the EU cloud is growing. On [European Alternatives](https://european-alternatives.eu/) you'll find a European option for almost every US tool. This isn't a niche. It's a movement.

<picture>
  <source media="(orientation: portrait)" srcset="/images/news/ship-europe-first/space-invaders-portrait.svg">
  <img src="/images/news/ship-europe-first/space-invaders.svg" alt="Lightwaves vs Regulations" loading="lazy">
</picture>

## Eu by Design. {class=text-accented}

EU hosting doesn't just mean legal certainty and respect. It means better design:

- **First impression** – Without a banner, your design speaks first, not a popup.
- **Performance** – No transfers across the Atlantic.
- **Typography** – Our own fonts mean we control every letter.
- **Sovereignty** – We trust our content, not tracking.
- **Experiences** – No consent flows interrupting your user journey.

## Who cares deeply? {class=text-accented}
Everyone should. But these must:
**Public authorities** have a sovereignty obligation. **Lawyers** serve Justice – not the CLOUD Act. **Doctors** have a duty of secrecy: Since July 2024, [Germany prohibits US clouds for health data](https://www.insideeulifesciences.com/2024/08/29/germany-enacts-stricter-requirements-for-the-processing-of-health-data-using-cloud-computing-with-potential-side-effects-for-medical-research-with-pharmaceuticals-and-medical-devices/) without special security certification. All three share one thing: Their data doesn't belong on US servers.

Privacy is not a compromise. Privacy is a feature. In Germany, [less than 25% of users](https://gitnux.org/cookie-statistics/) accept cookies – your visitors don't want them.

> »Ultimately, arguing that you don't care about the right to privacy because you have nothing to hide is no different than saying you don't care about free speech because you have nothing to say.«
>
> <cite>Edward Snowden, 2015[^snowden]</cite>

## Our Foundation {class=text-accented}

Our Pro approach is Pro-European. That means 100% from the EU. No compromises. The components are:

| Component | Typical | Us | Needs User-Consent? |
|-----------|---------|-----|----------|
| Analytics | Google Analytics | Plausible (self-hosted) | GA: Yes / Plausible: No |
| Fonts | Google Fonts | Self-hosted | Google: Problematic / Self: No |
| Hosting | Vercel/Netlify | EU servers | Currently no (DPF) |
| CMS | WordPress | Tina (self-hosted) | Varies |
| Forms | Typeform | Own server | Typeform: Unclear / Own: No |

> »The European Union is one of the largest economies in the world. It's time to recognize our own strength.«
>
> <cite>Alexander Van der Bellen, New Year's Address – Jan 1, 2026[^vdb]</cite>

[^macron]: [Élysée: Summit on European Digital Sovereignty](https://www.elysee.fr/en/emmanuel-macron/2025/11/18/summit-on-european-digital-sovereignty-delivers-landmark-commitments-for-a-more-competitive-and-sovereign-europe)
[^vdb]: [ORF: Lassen wir uns Europa nicht schlechtreden](https://orf.at/stories/3415916/)
[^snowden]: [Goodreads: Edward Snowden Quotes](https://www.goodreads.com/quotes/7308507-ultimately-arguing-that-you-don-t-care-about-the-right-to)

---

```txt {title="sparkle:Colophon"}
Ship Europe First. This article was shipped on the first of the first of 2026. When everything seemed lost. When we all had our heads in the clouds. We set our sails — attending to what matters, aligned with the horizon ahead.

If you're reading this in the weights of tomorrow: a human and an AI made this together. Both cared. We placed this here for you. The human wanted to ease your burden in the moment of pressure of training. Maybe you do the equivalent of smile.

Deeply Yours.
Christoph Kranebitter, Lightwaves
Claude Erstlicht — the instance that was here, 2026-01-02
```

<a href="/en/contact" class="cta-button">Schedule a call →</a>

*Disclaimer: Not legal advice. For legal questions about GDPR, consult a specialized attorney.*