6

Quite a few websites started showing european visitors "You cannot use this site because of GDPR", probably based on GeoIP information.

I see two possible legal problems:

  • GDPR forbids coupling of acceptance and the possibility to use. I am not sure if the GDPR wall is illegal or not as there is neither acceptance required on the page nor a possiblity to use the site.
  • The GDPR walls themself often miss a privacy policy (but most seem not to use tracking)
  • European citizens accessing the site when they are visiting non-european countries or via a (possibly anonymous) proxy probably have the same rights, but can access the site and will be tracked (or whatever the site does what does not comply with GDPR)

Are these walls a legal solution for these sites?

Here is an example from the Washington Post. You need to agree to tracking to continue to the site or you need to pay to avoid tracking.

Washington Post


Step 1: Washington Post GDPR-Wall 1

Step 2 (after clicking Free): Washington Post GDPR-Wall 2


Slate

Slate's implementation only offers an "agree" button, which leads you to their site, which probably uses tracking.


Slate GDPR-wall


From their privacy policy:

Slate tracks when EU readers grant consent for Slate to collect and process data through the use of an identifying cookie on your browser. 
  • 1
    "GDPR forbids coupling of acceptance and the possibility to use" — which article/recital provides that? – Greendrake Jun 7 '18 at 21:34
  • I am not sure, that's why I am asking. I think it was an interpretation about if consent is given freely, which should be interpreted on basis if performance of the contract is conditional on the consent (probably paragraph 7). – allo Jun 8 '18 at 8:18
  • I added an example from the Washington Post – allo Jun 13 '18 at 6:31
  • @Greendrake: None, of course. The GDPR states that consent must be freely given. This forbids one specific form of coupling, namely requiring consent to use a specific service, when the consent does not cover personal data necessary for the service but instead is used for other services. In particular, this kills free services with personalized ads. – MSalters Jun 17 '18 at 20:46
  • It does not kill anything, as long as you comply, i.e. remove personalized ads and use ads tailored to your content instead of to the user. The question is if requiring consent to tracking is okay. At least the GDPR aims to stop this practice, but this does not have to mean there are no loopholes which allow a GDPR wall in some way. – allo Jun 18 '18 at 7:37
6

If the website containing the GDPR-wall processes any personal data of users who hit the GDPR-wall, the GDPR applies to that website. This can be as simple as writing a logfile of all visits to the website. In this case it will be illegal if the website owner does not comply with the GDPR. However a supervisory authority would probably not spent any time on such a minor violation.

As long as the the website with the GDPR-wall does not process any personal data, the GDPR does not apply, so nothing in the GDPR can forbid the GDPR-wall.

Some related remarks:

  • The GDPR does not require a "privacy policy" on the website if the website does not process any personal data.
  • If personal data is processed based on consent, that consent must be freely given. Also it may not be disruptive. So a cookie wall asking for consent would be illegal. But the GDPR does not care about any other disruptive popups, as long as they are not related to asking for consent.
  • Using GeoIP is a perfect way to implement such a GDPR-Wall, because it would block everyone from within the EU, but nobody else. So it blocks exactly those for who the GDPR would apply. In such a case it would not be reasonable to expect anything more from a website owner. A user which uses a proxy, can not expect to be protected by the GDPR, because it bypasses a restriction set by the owner of the website.
  • A webserver does use the IP-address of all incoming requests, to send the reply back. That could be considered a processing of personal data, but everybody seems to agree it is not. I am not sure why. But I do agree that it would be very impractical if that is considered processing of personal data.

I added an example from the Washington Post

So you have to pay $9/month for a GDPR compliant subscription.

Because the price you have to pay is not unacceptable high, I think it would be valid to offer the premium version this way. This does not force you to choose one of the other subscriptions.

In december 2018, the Austrian DPA (DSB) has confirmed that a similar offer is lawful. On derstandard.at you get a choice between free access with tracking and advertising, or pay 6 Euro/Month for tracking free access. Because 6 Euro/Month is cheaper than subscribing to the printed edition, the DSB accepted that as a valid choice. More information can be found on noyb.eu or, (with more details but in German), on wbs-law.de.

  • 1
    Sending data back to the specified IP address is covered by the second GDPR condition that permits use of personal data, namely necessity. The user sends a request in a form where a response is expected (namely a webpage), where the technology necessarily requires a response IP address. As long as the IP address is used only for this purpose, the GDPR allows it to be used. – MSalters Jun 17 '18 at 20:52
  • 2
    “This can be as simple as writing a logfile of all visits to the website. In this case it will be illegal if the website owner does not comply with the GDPR.“ wrong, log files as long as they are used for their original intent (security) are excluded from the GDPR. If they are parsed for analytics such as what many control panels like cPanel or Plesk do then they violate the GDPR. – Shinrai Jun 17 '18 at 23:46
  • Geo-IP is not perfect. Errors in the databases can happen, and users can (and frequently do) use VPNs to evade IP-based limits on access. AFAIK you don't get a free pass for a European using a VPN to give themselves a US IP. – Paul Johnson Nov 22 '18 at 11:15
  • 1
    @PaulJohnson So a mistake of fact is not a defense, even if the person bringing the action is the very party that deliberately created the mistake of fact? That is difficult to believe. – Acccumulation May 27 at 3:44
  • 1
    @wimh You are quite right. See gdpr.eu/companies-outside-of-europe. I had often seen GDPR characterized as "protecting EU citizens and residents" - but that is actually wrong. It only protects them while they are in the Union (or if the controller is in the Union) – Martin Bonner supports Monica May 29 at 5:33
1

If getting through the wall requires the user to agree to the use of their data for advertising purposes, like the WaPo one in your example, then it is probably illegal. The GDPR does not allow use to be coupled with agreement to use personal data.

The Dutch data protection agency has clarified that this is the case and is currently taking enforcement action against violators.

  • 1
    Can you cite the particular bit of GDPR which says this? – Paul Johnson Nov 22 '18 at 11:15
  • 1
    @PaulJohnson Recital 43 includes: Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance. – wimh May 27 at 17:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.