-1

Due to some laws one wants to block certain countries from accessing his app which he uploaded on play console.One turns off those countries in GOOGLE play console so it cannot be downloaded in those country. Someone pirates it and aquires it. In EULA one clearly specifies the blocked countries and reasons for ban . Then writes -

"Use of this app is strictly prohibited if you are located or are a resident of or are a citizen or relate to anywhere outside the supported countries.You accept you are liable for any fines or damage we face if you continue."

So for EEA countries the users in EEA are told they are not allowed to use the app at all and must not keep it . If they continue to use they take the responsiblity to pay any GDPR fines or liblity for us. Thus it is strictlgy priohibited. Is such an agreement legal?

3
  • 2
    What is your question? Nov 4, 2020 at 15:17
  • Want to avoid GDPR . So can we add a statement in the EULA stating that EEA users are not allowed to use the app published. If they do they must pay for all liablities we face due to them.(Because its next to impossible to comply with GDPR for apps that want to make anything). Nov 4, 2020 at 16:10
  • 4
    So long as you aren't being a dick with users data, the GDPR is actually trivial to comply with. Your assertion that its impossible to comply with the GDPR is just wrong - the apps which don't comply with the GDPR and don't seem to want to make any effort to comply with the GDPR are apps which I simply don't want to have my personal data in the first place. Your Admob example just means you don't understand what is a data controller and what is a data processor, and what those roles mean. Its perfectly possible to have an app where you are not the data controller for most data (ie browsers).
    – user28517
    Nov 4, 2020 at 21:37

2 Answers 2

4

If you can’t stand the heat, get out of the kitchen

The thrust of this question, as well as many others you have posted, seems to be looking for a way of avoiding your obligations under the GDPR because they are difficult, onerous and/or expensive.

Too bad!

You don’t have the option of which laws you comply with and which ones you don’t. If I had my choice, I’d comply with the GDPR and not with tax law, but I don’t so I can’t.

You have 3 simple choices:

  1. Do your best and insure the rest. This means learning what’s required and implementing it to the best of your ability and taking out appropriate insurance cover to deal with any mistakes you make.
  2. Ignore the law and hope you don’t get caught.
  3. Don’t release apps.
1
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Dale M
    Nov 6, 2020 at 0:17
3

If GDPR applies, then trying to skirt your responsibilities with such terms of service would be blatantly illegal. A contract that tries to pass your fines on to users would not hold up in court. See also Dale M's answer.

However, GDPR might not apply to you. When we look into Art 3 GDPR (territorial scope), we find this:

2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

Translated from legalese to English: as a non-EU data controller, you do not have to comply with the GDPR unless you are monitoring/tracking/profiling persons in the EU, or if you are offering services to people in the EU.

This “offering” means that you must be actively targeting the EU market and reasonably expecting people in the EU to use your app. This is a lot about your intention and marketing, not so much about whether you effectively prevent people in the EU from using your app. Recital 23 provides some details:

Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.

Mere accessibility of your service doesn't matter. But e.g. if you were marketing your app in Polish, that could be an indication that you're targetting people in the EU. The EDPB guidelines 3/2018 on territorial scope provide in-depth discussion of this “targeting criterion” and other aspects.

There is a question what measures you can take to make it clear that you're not offering services to people in the EU. Many websites block visitors from European IP addresses. I think that is effective, but goes beyond what would be actually required. You mention that you could prevent downloads from certain countries. Again, that sounds fairly effective, but might even go beyond what is required. However, text that is hidden somewhere in your terms of service does not sound particularly effective.

There is one gotcha though: the GDPR applies with regards to people in the EU, not people from the EU. If a user installs your app outside of the EU but then travels into the EU and uses your app there, we have to look into what your app is doing. You're clearly not offering/targeting goods or services. But monitoring the user's behaviour through the app could bring you into scope. The EDPB guidelines linked above contain an example of an app that is targetted towards tourists who visit EU cities. Such an app might monitor user behaviour such as location e.g. to alert users to nearby points of interest. Note that even if you don't intentionally monitor behaviour, some libraries or SDKs that you integrate might, especially advertising frameworks.

7
  • So if I explicitly stated this app is not targeted for EU users and do not collect any personal info I will not have to face Erasure or other requests. I will only link to GOOGLE'S procedure of data removal. Nov 5, 2020 at 5:17
  • In case I use AdMobr. Nov 5, 2020 at 5:31
  • I have recieved several answers to several questions but not seemto clarify "IF I USE ADMOB IN AN APP BLOCKED FOR EU COUNTRIES WHAT ARE MY LIABLITIES?" Nov 5, 2020 at 7:12
  • @compenthusiast I don't want to take any stance on AdMob as that would get too close to legal advice.
    – amon
    Nov 5, 2020 at 7:14
  • ok but your opinion just? Nov 5, 2020 at 7:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .