The user's browser makes a request to a US server, including the user's IP address.
I legit do not understand how to make French people happy with these laws.
The regulations don't ban collecting IPs (nor any PII). They just regulate it to the point that it must be deemed necessary according to certain criteria. I would imagine linking an image may be fine in 95% of cases, but what it would mainly depend on is the logging practices of the image hosting company. Their business would be bound by EU regulation if they are choosing to sell service to an EU-based website, and it's likely that image host that would be liable for compliance.
It's worth adding quite a lot of the regulation here is tied to company size, revenue and scale of data sharing in general, so if you are for example a small business/non-profit you're very likely to be fine either way.
if the purpose is to collect PII and build advertising models like it was with the google fonts or the 1 pixel images then it is not ok.
Is the image hosting company really _choosing_ to sell service to an EU-based website if someone adds <img src="http://blah.us"> to their (French) website? It seems like it'd be an unreasonable expectation upon a company (especially one in a completely different country/jurisdiction) to e.g. ensure their existing logging practices _also_ comply with French, Austrian, etc laws.
Surely the user who adds/posts the image on a French site would/should be liable here, not the host of the US-based image (service?), no?
In the latter (hotlinking) case the French website would almost certainly be entirely responsible if they operate at scale (excepting user generated content). In the former, it's obviously less clear cut (and also as mentioned revenue & scale are going to be very relevant).
Practical example: a private individual posts a hotlinked image on a French forum. Relevant questions:
- is that user profiting at large scale from data logged on the image server? No.
- is the forum website owner? No.
- is the image host deriving revenue directly from proactively collecting, analysing and profiling user data from readers of that forum post who are based in the EU? Possibly.
- is the image host doing so at large scale? Maybe.
3 & 4 are definitely true of Google Analytics, but broadly won't be true of many image hosts, so your image linking example won't be an issue most of the time.
I've often found the slippery slope 'Fallacy' to not be so much of a fallacy in reality when it comes to power.
[Edit] for clarity