# Spring Boot privacy rating

Java framework from the Spring project for building standalone applications, with auto-configuration, embedded web servers and starter dependencies.

## Summary

Spring Boot scores 50 out of 100 (grade D) on the Java and Kotlin frameworks criteria. It meets 2 of 4 criteria: open source and no ads or data sales. It does not meet no trackers or telemetry and independent audit. It is based in the United States: Five Eyes member; subject to the US CLOUD Act.

- Website: https://spring.io/projects/spring-boot/
- Source code: https://github.com/spring-projects/spring-boot
- License: Apache-2.0
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Platforms: Linux, macOS, Windows
- Home page trackers: Cloudflare Web Analytics (cookieless analytics), Google Tag Manager, OneTrust (not scored)
- Category: [Java and Kotlin frameworks](https://privacyratings.com/jvm-frameworks/)
- Grade: D (50/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Yes | Apache 2.0-licensed. | https://github.com/spring-projects/spring-boot/blob/main/LICENSE.txt |
| No trackers or telemetry | No | The framework has no telemetry, but the spring.io website loads Google Tag Manager, OneTrust and Cloudflare Web Analytics. | https://spring.io/projects/spring-boot/ |
| No ads or data sales | Yes | Developed by Broadcom and funded by its paid Tanzu Spring support, with no ads in the framework. | https://enterprise.spring.io/ |
| Independent audit | No | No independent audit is published. |  |

Source: https://privacyratings.com/jvm-frameworks/spring-boot/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/jvm-frameworks/spring-boot.md