miji.beURL shortener compliance refers to the overall efforts to comply with laws and regulations such as the GDPR, the CCPA, and the Telecommunications Business Act (Denki Tsushin Jigyo Ho) in operating a URL shortener. It also includes understanding the legal obligations regarding the collection / storage / use of click data and building a system in line with them.
From the perspective of the EU's GDPR, the IP address, User-Agent, referrer, and other data collected when a short URL is clicked may constitute personal data (Recital 30 lists IP addresses among the examples of online identifiers that can be associated with individuals). Processing requires one of the legal bases in Article 6(1) (such as consent or legitimate interests). Article 13 provides that, when personal data is obtained from the data subject, the purposes and legal basis of the processing, the storage period (or, if it cannot be determined, the criteria for it), and other information are to be provided to the data subject. Article 17 contains the right of the data subject to request erasure (the right to be forgotten).
According to the California Attorney General's page (as of August 2026), the CCPA (California Consumer Privacy Act) applies to for-profit businesses that do business in the state and meet certain requirements. Consumers have rights such as the right to know the personal information collected, the right to request deletion (with exceptions), and the right to refuse its sale or sharing. When a URL shortener provides click data to third parties, whether that provision counts as a "sale" depends on the terms of the provision.
In Japan, according to the Ministry of Internal Affairs and Communications page (as of October 2026), the June 2022 amendment to the Telecommunications Business Act established the external transmission rules (gaibu soshin kiritsu), and the amended act took effect on June 16, 2023. The rules apply when a business that provides a covered telecommunications service through a browser or app sends the user's device a program or the like that instructs it to make external transmissions. In that case, the business is to take one of the following measures: notification or public announcement, obtaining consent, or an opt-out.
Article 20 of the GDPR sets out the right of the data subject, where processing is carried out by automated means on the basis of consent or a contract, to receive the personal data they have provided in a structured, commonly used, and machine-readable format. Some services offer a feature to export the list of short URLs and click statistics in JSON or CSV. Because the measures required can change with legal amendments and court rulings, some operators keep checking developments on an ongoing basis.