A website that I visited posted the following: “YOUR PRIVACY IS IMPORTANT TO US. New regulations in your country require you to agree to our terms of use agreement and privacy policy before you can continue using this website”

The first sentence is an obvious lie (they only care about my data, not my privacy). But I would have thought GDPR required them to respect my privacy, not deny access.

Is what they are doing (only allowing access in exchange for giving up privacy rights) legal under GDPR?


No, it is not legal.

Regardless of their location, the only legal options for companies serving to EU residents are to either deny access altogether or to make consent truly optional1

Recital 42 states (emphasis mine):

Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement[...]

Recital 43 states:

Consent is presumed not to be freely given [...] or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.

1 Of course, remember that consent is only one of several means that allow them to process data.

For example, if you were getting a trial account for a limited time, it would be considered a legitimate business need to ensure that you are not just opening new trial accounts when the old ones expire. So, if they wanted some data from you to ensure that you are not a previous user and you refused to provide it, then they could deny giving you that trial account without breaking the GDPR.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.