7

Example:

  • A US user downloads the Android app from the US Google Play Store
  • The user does not view any consent form and begins using the app and viewing ads
  • The user then travels to EEA/UK and continues viewing ads

Would a consent form be required to adhere to GDPR in this instance, even if personalised ads are disabled for EEA/UK users?

6

The GDPR roughly applies in the following scenarios:

  • Art 3(1): you have an establishment in Europe
  • Art 3(2): you do not have an european establishment, but
    • Art 3(2)(a): offer goods or services to persons in Europe
    • Art 3(2)(b): monitor the behaviour of people who are in Europe

(where Europe means EU/EEA/UK as appropriate).

Art 3(1) does not seem to apply for you. Art 3(2)(a) does not apply, since you're not actively targeting people in Europe. At the point in time where you are offering the app to users, those users are in the US.

Art 3(2)(b) could apply if you collect some kind of tracking data, in particular (but not limited to) location data. But if you temporarily shut down collection of new data for personalisation while the user is in Europe, that's probably going to be reasonably safe. It might not be necessary to disable ad personalisation if that personalisation is based on data collected outside of Europe. In practice, unless your app is specifically targeted at travellers, no one will care about what your app does outside of the US.

For detailed guidelines on the territorial scope of the GDPR, consider reading EDPB guidelines 3/2018 (PDF). The document contains some relevant examples, but since it's official guidance they won't explicitly say that GDPR won't apply in a scenario like yours. The closest is Example 8:

An Australian company offers a mobile news and video content service, based on users’ preferences and interest. Users can receive daily or weekly updates. The service is offered exclusively to users located in Australia, who must provide an Australian phone number when subscribing.

An Australian subscriber of the service travels to Germany on holiday and continues using the service.

Although the Australian subscriber will be using the service while in the EU, the service is not ‘targeting’ individuals in the Union, but targets only individuals in Australia, and so the processing of personal data by the Australian company does not fall within the scope of the GDPR.

Also relevant is Example 10, which says that app downloads in the EU might not be subject to GDPR:

A U.S. citizen is travelling through Europe during his holidays. While in Europe, he downloads and uses a news app that is offered by a U.S. company. The app is exclusively directed at the U.S. market, evident by the app terms of use and the indication of US Dollar as the sole currency available for payment. The collection of the U.S. tourist's personal data via the app by the U.S. company is not subject to the GDPR.

3
  • Note: AFAIK it's primarily the processing of data that GDPR covers, not the collection of data. So 'the processing of data collected outside the EU of a user who resides in the EU' would AFAIK fall under GDPR. Jul 29 at 6:35
  • @David Mulder Under GDPR Art 13 a variety of notices must be provided when data is collected, and processing, at least in the form of storage starts at collection, so both are covered. Jul 29 at 15:09
  • @DavidMulder Collection is a processing activity per Art 4(2), and residency of the data subject is not a direct factor. I think that for OP, the most important question is whether any processing activities relate to the monitoring of behaviour of people in Europe.
    – amon
    Jul 29 at 17:53
4

The GDPR applies to interactions with any users who are currently inside the EU, even if they were not in the EU when the first accessed the service, or indeed the day before. If a person currently in the EU uses the service and personal information (PI) is collected or processed as a result of that interaction, there must be a lawful basis, often user consent. This is covered by GDPR article 3 on territorial scope, and GDPR article 6 on lawfulness of processing.

However, the GDPR does not apply at all if the Data Controller (DC) is outside the EU and the service does not "target" any areas in the EU (member countries or parts of member countries) and also does not "monitor behavior" of people in the EU. If the service is not advertised in the EU, and is not provided in EU languages that are not languages of the country where the DC is located, fees (if any) are collected only in non-EU currency, and efforts are made to exclude people resident in the EU, that might be sufficient evidence that people in the EU are not being targeted.

See GDPR Recital 23 for more on targeting.

If a service is targeting the EU, it may be simpler to ask for consent from all users than to try to determine who is and who is not in the EU to apply different rules.

Note also that if the DC (or the relevant establishment of the DC) is located in the EU, then the GDPR applies to all transactions and all PI processed, no matter where the data subject is located, and either consent or some other lawful basis is required.

4
  • Thank you very much for your explanation. Just to be clear, if the DC would be (at this moment in time) a developer from inside the EU targeting users outside the EU in English language does this mean that the GDPR rules do in fact apply?
    – roguedev
    Jul 29 at 1:48
  • 1
    @roguedev If the DC is located in the EU, then the GDPR applies to all transactions, no matter where the data subject is located, and either consent or some other lawful basis is required. Jul 29 at 3:18
  • @roguedev see my now revised answer. Jul 29 at 15:19
  • Thank you very much this is very clear!
    – roguedev
    Jul 29 at 16:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.