0

I've a question. We would like to show a pop-up to users outside Europe to inform them we also have an American website as soon as they visit the website. We check the location based on their IP-address. We don't store the IP in a cookie or a session, just to show the pop-up.

Is this possible without the consent of the user?

Thanks in advance!

2
  • can't you just redirect based on IP? I get a redirect to special "we don't operate to people in the EU" from sites as well as a redirect to a special "we don't cater Germany" from german IPs to Project gutenberg.
    – Trish
    Dec 23, 2020 at 14:03
  • 1
    @Trish Unless you're outright refusing service, it's generally considered bad UX design to just redirect. It's also not clear to me how redirecting instead of showing a popup makes a difference, legally - you're still processing the same data. Dec 23, 2020 at 15:57

2 Answers 2

5

Under GDPR Article 6 section 1(f), a lawful basis for processing is:

processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

It seems that informing a data subject of the availability of a possibly better-focused related site would be a "legitimate interest", and merely doing a broad geo-locate on the IP does not seem to impact the "interests or fundamental rights and freedoms of the data subject" so it would seem this could be done without specific consent in advance. I don't know of any legal case on this specific point, however.

1
  • Additionally, we can consider ePrivacy, which stipulates that traffic data can only be used as necessary for performing the service requested by the user (and some other cases). IP addresses clearly are traffic data. However, there's a decent argument that showing a popup about the existence of a more targeted site is necessary. A popup offering a choice is much better than an automatic redirect, but it might be sensible to set a cookie to avoid showing the popup on each page, should the visitor decide to stay on the page.
    – amon
    Dec 24, 2020 at 10:25
0

Can I use an IP-address to show country pop-up without consent?

Yes. The answer posted by David Siegel is accurate, but another reason is that country clearly is insufficient data for identifying a natural person. See article 4(1) of the GDPR.

Even if coupling it with other data leads to identification (see preamble 30), it is obvious that country contributes negligibly or not at all toward identifying a natural person. It is the other information which materially enables identification.

2
  • 1
    Yes, but the IP address can identify a person, so processing that requires a lawful basis, I would think. Dec 23, 2020 at 22:29
  • @DavidSiegel The way how ranges of IP addresses are assigned implies that the OP does not need to use the whole IP address if he is interested to retrieve only the country. That precludes identification of persons. Dec 23, 2020 at 23:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .