Description:
In the current state of the core code, and in many examples, it is made call to github cdn or other websites for assets and eventually components.
In Europe since the the publication of the GDPR rules and more recently the Schrems II EUCJ ruling, the transfer of a website users data to a third party and more precisely ones located outside EU (and particularly in the US or under US-based company control) without specific informed consent from the user is outlawed.
So for an unknowing person/organisation in Europe making use of the current distribution of Aframe without modification is liable and not "GDPR Compliant" because they cannot control the flow of data on their website for their users.
This has huge consequence many don't (want to) see actually, but the good news is Aframe is easily fixable with a few things :

Distribute the /controller and /fonts directory from the assets rep inside a /asset directory in Aframe directly, and replace any occurrence of links to https://cdn.aframe.io and copy the https://dpdb.webvr.rocks/dpdb.json in the same asset dir while also replacing it's https://dpdb.webvr.rocks link in aframe(.min).js by the same /asset/ dir ...

this way Aframe is self contained, can work locally and does not leak user information to other possibly unwanted parties [edit] and also work without problem for people using "no-script" browser addons that restrict the use of external javascript ...

• A-Frame Version: all using hardcoded external links to cdn/websites for assets
• Platform / Device: all
• Reproducible Code Snippet or URL: