5

There's a new law from the European Union I simply cannot comply with (GDPR). Its way to complex, not even big companies can comply with it. I also don't know what google does with the data from my visitors.

If I let a checkbox pop up on every page that the users need to confirm they're not from the EU nor using the site from the EU, would it be fine?

Is it allowed to exclude people on that way? Will I still be affected by the GDPR if I forbid all acces from people from the EU and acces from within the EU?

  • 4
    Before you go ahead and make everybody that visits your blog miserable, you may want to look at the answers to this question. TL;DR: Unless you are in the EU yourself, or do business or provide services to the people who are present in the EU, you don't need to comply with the GDPR. Simply having you blog accessible to European is not running a business or providing a service in the EU. – Free Radical Jun 5 '18 at 16:13
  • @FreeRadical unfortunately my country accepted the GDPR (even tho we're not in the EU). Thus it looks like it applies to me. – Swizzler Jun 5 '18 at 16:54
  • 3
    @FreeRadical While I think you're correct, I also think you're discounting the number of differing interpretations of the law. I've even seen people claiming that the GDPR applies to American businesses, in America, when their customer is a visiting EU resident (and they quoted passages from the text of the law in support!). In my opinion, the biggest burden from the GDPR is the (intentional?) vagueness of their rules, leading to extreme CYA reactions from many businesses. – kbelder Jun 5 '18 at 17:02
  • @FreeRadical I'd also like to add: I rather make my blog miserable to the two souls who visit me once a month than paying a fine of 20Mil € – Swizzler Jun 5 '18 at 17:27
  • 1
    @FreeRadical: "Simply having you blog accessible to European is not running a business or providing a service in the EU." - some prefer to err on the safe side, unfortunately for those in the EU who do not know how to use a proxy. – O. R. Mapper Jun 9 '18 at 20:51
1

In a similar question I answered:

As long as the the website with the GDPR-wall does not process any personal data, the GDPR does not apply, so nothing in the GDPR can forbid the GDPR-wall.

But even if the GDPR would apply;

If personal data is processed based on consent, that consent must be freely given. Also it may not be disruptive. So a cookie wall asking for consent would be illegal. But the GDPR does not care about any other disruptive popups, as long as they are not related to asking for consent.

You do not ask for consent, you simply ask for someone's location.

So if you place a checkbox pop up on every page that the users need to confirm they're not from the EU nor using the site from the EU, that would be fine provided you do not process any personal data before the popup is shown.

However, this might lead to everybody from the EU saying they are not from the EU. In that case, the checkbox has no meaning any more, so it won't work what you are trying to do. This would be expressed in existing laws, not the GDPR itself. Note that in Europe (as far as I know) laws are not explained literally as written down, but they will be explained as what they are trying to achieve. That is also why the GDPR has so many recitals, they explain how the binding articles have to be interpreted. (Note that criminal laws are an exception to what I just described).

In particular if your blog shows ads or content directed to visitors from the EU, it will be assumed the checkbox has no meaning.

But it should not really be difficult for a blog to comply to the GDPR. For things like google analytics a lot of documents exists explaining how you need to configure it to be GDPR compliant.

0

Making a wall to access your site is against the GDPR. Technically GDPR applies to everyone who runs a website and yes even brick and motar shops who ever deal with EU citizens.

Specifically the GDPR is a law for EU citizens personal data. So at any point if you collect personal data or track an EU citizen (ie analytics) then you are in the scope of the GDPR. Analytics can have its stored personal data (up address) anonomyzed. At which point you fall out of the GDPR scope as the IP address is no longer specific and thus not personal data. However if you use say the user id option of google analytics then that is then considered in scope of the GDPR.

Then you have the issue if the visitor can create an account. If you allow simply username and password as registration then you are not in scope of GDPR. However if you collect a name or an email than you are in scope of the GDPR.

The GDPR also addresses that you cannot provide a service in which consent is a requirement. In your case your consent is at the option of asking if they are an EU citizen or not. This would clearly violate the freely given consent clause in the GDPR.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.