Would a VPN user still be under GDPR protection?

Question

I got a client that wants to remove the 'GDPR please accept our cookies' banner when the user is NOT in the EU. (Its an NA based company)

So the way we could do it, with PHP, would be to check the IP of the user, by some black magic figure out on the fly where that comes from and then if the country is not within the list of countries of the EU, well dont show the bar.

But my insecurity posed this. Say a user, from the EU, uses a VPN. Those services announced everywhere that can spoof their IP and make it seem like the user is from somewhere else (like what they advertise is make Netflix think you are in japan, so you got the japan Netflix library). Would that user still be subject to GDPR?

To wrap it up: Would a user that is physically in the EU, but spoofs their IP to trick the code into thinking he's not still be under GDPR protection (and thus, if you don't make him accept the cookies, you could be in legal trouble)

Answer 1

There are several misunderstanding in this question.

First of all, the GDPR applies based on whether a user is actually located in the EU or not, and an IP address is not a fully reliable way of determining this. There are various ways in which the geolocation of an IP might be incorrect. Use of a VPN is only one.

Secondly, the GDPR does not apply at all if the Data Controller (DC) is not "targeting" a site at people in the EU (nor monitoring the actions of such people). If all advertising for the site is clearly aimed at North America, say, and no other evidence suggests targeting, the GDPR will not apply to DCs not located in nor having establishments in the EU.

Thirdly, the rules on cookie consent are not part of the GDPR at all. They are found in the e-privacy directive, which must be implemented in national law by each EU member to be effective in that nation. There is a proposed e-privacy regulation (which would apply to the whole EU) but the EU has not yet agreed on the exact provisions, so it is not yet in effect.

Fourthly, under e-privacy, cookies are divided into two categories. Cookies that are strictly necessary for the operation of the site do not need consent, but must be disclosed to every user. Other cookies require consent, and must also be disclosed.

Fifthly, this is not just a matter of the EU. The CCPA also imposes some limits on cookie use by sites that interact with people in California, and Colorado and Virginia have recently passed data protection laws which are not yet in effect, but soon will be. It may be simpler to obtain consent for any non-essential cookies from all users, but that is a business decision.

Answer 2

You can probably remove banners for non-European IPs, but there's no clear case law or guidance on this matter.

The GDPR does not apply to all websites that are accessible from Europe. A non-European website only has to comply for those activities that relate to the offering of goods or services to people who are in Europe. This offering or targeting implies an active intention, or at least an awareness about nontrivial levels of European interest. So most websites from outside of Europe can completely ignore the GDPR and cookie requirements, since they're not actively targeting people in Europe. It is not possible for a person from Europe to entrap a foreign business into having to comply with GDPR.

Strong indications that a website is targeting people in Europe could be localizations (e.g. Dutch and French translations) or a B2C webshop that advertises shipping to Europe or accepts European currencies (like EUR, NOK, or GBP). But this depends on context, e.g. French text might just relate to Canada.

If you have country-specific sub-sites, it would make sense to treat all subsites targeted towards Europeans as fully subject to GDPR, regardless of where the visitor appears to come from. A US-specific subsite would not be targeting people in Europe and would then be entirely exempt. I believe that it is reasonable to use connection data such as IP addresses or browser language preferences to redirect a new user to an appropriate subsite upon first visit, but this redirection would be related to targeting people in Europe.

Without such clear subsites the distinction is more tricky, but I believe that a GeoIP lookup of the visitor IP address is a reasonably good approach for determining what laws you have to follow with respect to them, at least as long as you don't have any indications otherwise. How much effort to pour into this is a question of risk management. E.g. a larger service might tag traffic from known VPN addresses as having an unknown geographic location, and might apply the strongest compliance rules to them just to be safe. Indeed, Netflix generally blocks VPN traffic, but they're more concerned with content licensing than with data protection.

Disclaimers:

• In this answer, Europe means EU/EEA/UK as appropriate.
• Cookie consent is governed by the ePrivacy directive which was implemented separately in every European country. Within the EEA, every website only has to follow the version from its own country. Outside websites likely have to follow the versions from all country in which they have users. For simplicity's sake, I am assuming that the ePrivacy implementations are a specialization of the GDPR and inherit its territorial scope which is more clearly defined.