1

I would like to display a Google Map in a website project of mine.

This requires loading the JavaScript api from Google:

https://developers.google.com/maps/documentation/javascript/tutorial?hl=en#Loading_the_Maps_API

By loading this JavaScript api, every user which is opening my page is sending a request to Google, and thus "shares" their ip-address with Google.

According to my lawyer, the ip-address is personal data, since it might allow identifying the user (provided the user is not behind a proxy or connecting to the internet through a shared address, like e.g. from mobile networks)

Do I need to get consent from the user to force him/her into sending his/her ip-address to Google my accessing my site?

  • If your lawyer considers the IP addresses to be personal data, you should get his advice on a TOS and consent; we can't give legal advice here. – BlueDogRanch Apr 20 '17 at 16:37
2

IANAL, but I"m assuming by "consent" you mean you feel you need to have users click through an agreement to acknowledge and clearly accept the fact that the site is sending their IP information to Google?

I'd say it's your choice to use a click through advisory for the data collection by Google. But at a minimum in your situation, I'd say it's a very good idea to have a terms of service and a privacy statement for users of your site to inform them that the Google API is being used and Google is collecting their IP address. Both statements can be linked in the footer, like everyone else seems to do. And a TOS is a contract: see Are terms of service legal contracts?

So even if users don't read it or you don't force a "click through," the TOS is in place, and users will consent to their IPs going to Google if you state in the TOS that users agree to the TOS by their use of the site. Which is pretty standard TOS wordage.

It's your choice to have a banner or a click through to point them out to users or even force a click through agreement. Realize that, in the EU, click through advisories are required to inform of cookie usage: http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm

I.e, Stack Exchanges own privacy policy on collecting IPs:

When you use the network, we also collect potentially personally identifying information in the form of Internet Protocol (IP) addresses. But we don’t use that information to identify you, and we handle and disclose these addresses in the same way we handle other potentially personally identifying information as described below. https://stackexchange.com/legal/privacy-policy

Any site advertisements are collecting data, too. And be aware that your own webserver is logging user IP addresses, beyond Google and ads, and that should be covered in your TOS and privacy statement.

One of the many online TOS generators is probably sufficient for your site, if the only thing you are doing is dealing with user IPs and you're not a business or government entity: https://duckduckgo.com/?q=tos+generator . If in doubt, ask a lawyer.

Update:

If your lawyer considers the IP addresses to be personal data, you should get his advice 1) on a TOS for your site that covers the privacy concerns of users and protects you, and 2) if he feels the TOS should be click-though to force the user to clearly consent to and accept the TOS. This decision is up to you, as we on LE can't offer legal advice.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.