2

I got a client that wants to remove the 'GDPR please accept our cookies' banner when the user is NOT in the EU. (Its an NA based company)

So the way we could do it, with PHP, would be to check the IP of the user, by some black magic figure out on the fly where that comes from and then if the country is not within the list of countries of the EU, well dont show the bar.

But my insecurity posed this. Say a user, from the EU, uses a VPN. Those services announced everywhere that can spoof their IP and make it seem like the user is from somewhere else (like what they advertise is make Netflix think you are in japan, so you got the japan Netflix library). Would that user still be subject to GDPR?

To wrap it up: Would a user that is physically in the EU, but spoofs their IP to trick the code into thinking he's not still be under GDPR protection (and thus, if you don't make him accept the cookies, you could be in legal trouble)

9
  • Clarification: If you are compliant with GDPR, you cannot "make" people accept cookies. That is, in fact, the whole point of GDPR. If your cookie banner tries to "make" people accept cookies, then it is not compliant and you have a rather more serious problem than "people might use a VPN."
    – Kevin
    Aug 3 at 17:52
  • Well we are not asking the form with 20 checkboxes, its a small company. Its basically 'Click accept or leave' which is a choice that, well, I'm pretty sure makes us compliant. I am not the most versed in the GDPR law (from Canada, so its not in my wheelhouse) but do you absolutely need the site to still be readable, even without cookies, to be GDPR compliant?
    – Fredy31
    Aug 3 at 17:55
  • 1
    @Fredy31: That's a whole other question, but in short, "click accept or leave" is usually only allowed if it would be literally impossible for your site to provide basic functionality without cookies (and in particular, advertising/tracking cookies are out).
    – Kevin
    Aug 3 at 18:19
  • @Kevin So with GDPR an informative site should be readable without the cookies? Guess I'll have to work on my stuff a little more.
    – Fredy31
    Aug 3 at 18:30
  • 1
    The GDPR isn't the relevant legislation anyway. e-privacy is, and is undergoing revision. There are also now UK versions of the GDPR and of e-privacy. Aug 3 at 19:10
2

There are several misunderstanding in this question.

First of all, the GDPR applies based on whether a user is actually located in the EU or not, and an IP address is not a fully reliable way of determining this. There are various ways in which the geolocation of an IP might be incorrect. Use of a VPN is only one.

Secondly, the GDPR does not apply at all if the Data Controller (DC) is not "targeting" a site at people in the EU (nor monitoring the actions of such people). If all advertising for the site is clearly aimed at North America, say, and no other evidence suggests targeting, the GDPR will not apply to DCs not located in nor having establishments in the EU.

Thirdly, the rules on cookie consent are not part of the GDPR at all. They are found in the e-privacy directive, which must be implemented in national law by each EU member to be effective in that nation. There is a proposed e-privacy regulation (which would apply to the whole EU) but the EU has not yet agreed on the exact provisions, so it is not yet in effect.

Fourthly, under e-privacy, cookies are divided into two categories. Cookies that are strictly necessary for the operation of the site do not need consent, but must be disclosed to every user. Other cookies require consent, and must also be disclosed.

Fifthly, this is not just a matter of the EU. The CCPA also imposes some limits on cookie use by sites that interact with people in California, and Colorado and Virginia have recently passed data protection laws which are not yet in effect, but soon will be. It may be simpler to obtain consent for any non-essential cookies from all users, but that is a business decision.

2
  • It's EEA, not EU. GDPR also applies to Norway, Iceland and Liechtenstein.
    – erebus
    Aug 3 at 19:20
  • ...by virtue of Annex XI to the EEA Agreement, in which "EFTA States" excludes Switzerland. So technically yes, the GDPR applies to the EU, but those provisions are extended and also, separately, apply in the EEA EFTA States. In practice, if you target users in Norway, you have to comply with the GDPR just as you would if you targeted users in France.
    – Sam_Butler
    Aug 19 at 15:52
1

You can probably remove banners for non-European IPs, but there's no clear case law or guidance on this matter.

The GDPR does not apply to all websites that are accessible from Europe. A non-European website only has to comply for those activities that relate to the offering of goods or services to people who are in Europe. This offering or targeting implies an active intention, or at least an awareness about nontrivial levels of European interest. So most websites from outside of Europe can completely ignore the GDPR and cookie requirements, since they're not actively targeting people in Europe. It is not possible for a person from Europe to entrap a foreign business into having to comply with GDPR.

Strong indications that a website is targeting people in Europe could be localizations (e.g. Dutch and French translations) or a B2C webshop that advertises shipping to Europe or accepts European currencies (like EUR, NOK, or GBP). But this depends on context, e.g. French text might just relate to Canada.

If you have country-specific sub-sites, it would make sense to treat all subsites targeted towards Europeans as fully subject to GDPR, regardless of where the visitor appears to come from. A US-specific subsite would not be targeting people in Europe and would then be entirely exempt. I believe that it is reasonable to use connection data such as IP addresses or browser language preferences to redirect a new user to an appropriate subsite upon first visit, but this redirection would be related to targeting people in Europe.

Without such clear subsites the distinction is more tricky, but I believe that a GeoIP lookup of the visitor IP address is a reasonably good approach for determining what laws you have to follow with respect to them, at least as long as you don't have any indications otherwise. How much effort to pour into this is a question of risk management. E.g. a larger service might tag traffic from known VPN addresses as having an unknown geographic location, and might apply the strongest compliance rules to them just to be safe. Indeed, Netflix generally blocks VPN traffic, but they're more concerned with content licensing than with data protection.

Disclaimers:

  • In this answer, Europe means EU/EEA/UK as appropriate.
  • Cookie consent is governed by the ePrivacy directive which was implemented separately in every European country. Within the EEA, every website only has to follow the version from its own country. Outside websites likely have to follow the versions from all country in which they have users. For simplicity's sake, I am assuming that the ePrivacy implementations are a specialization of the GDPR and inherit its territorial scope which is more clearly defined.
2
  • I think that "the ePrivacy implementations are a specialization of the GDPR and inherit its territorial scope" is incorrect, but I am not sure. Aug 3 at 19:35
  • @DavidSiegel I agree that it's probably incorrect, strictly speaking. While ePrivacy is a lex specialis to the GDPR's lex generalis, its subject matter is partly out of the scope of the GDPR and it doesn't “inherit” the territorial scope. I think the more correct argument is that a country's ePrivacy implementation will apply to a website if it is directing an activity towards consumers in that country. This leads to the same case law such as Alpenhof v Heller that is used as the basis for interpreting the GDPR's targeting criterion. But I know next to nothing about conflict of laws.
    – amon
    Aug 3 at 20:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.