15

I recently chatted with a colleague who is preparing to launch a social networking and forum website which targets a relatively narrow audience (for discussion, let's say it is a dating site that solicits personal information to help find potential matches.)

He was primarily asking for my feedback on his technical design (which I provided), but I also noted he is planning to blacklist/block ALL connections from the EU due to GDPR regulation. His terms of service also prohibit users from connecting from any EU jurisdiction :(

Anyways, this project is his personal venture. He's open to anyone in the world using the service, but is excluding EU because he just doesn't want to deal with any of the legal headaches/uncertainty from GDPR. (Apparently many US media outlets [and others] which presumably have large legal teams have taken the same mass-blocking approach...)

Still, blocking a potentially useful free service from the entire EU just feels so regressive/anti-collaborative to me. If I lived in the EU, I would be pretty ticked to be blanket-excluded from services that I may otherwise choose to use.

Does anyone know if there is a way for users in the EU to waive their GDPR rights in order to use a non-GDPR compliant website? (I suspect not, but just wanted to check whether there was a way to avoid a GeoIP & TOS access block?)

The service will be hosted in the US and replicated via CloudFlare's Content Distribution Network.

Edit: Thanks for everyone's answers and comments. I posted another follow-up question:

Why is the onus for adhering to privacy directives (e.g. GDPR, CCPA, etc.) on a host and not the user?

1
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – feetwet
    Jul 18, 2022 at 17:26

3 Answers 3

20

If GDPR applies, then no one can opt out. If it doesn't apply, then an IP block is superfluous.

Whether GDPR applies is determined by Art 3 GDPR. For this, we must distinguish where the data controller is operating from. It is irrelevant where the site is hosted, but primarily relevant where the data controller (your colleague) has an “establishment”, e.g. where he resides or typically works from.

  • Per Art 3(1), GDPR applies to all processing activities in the context of an European establishment, regardless of where the users are.

    So if your colleague were running this site from Europe, they wouldn't be able to circumvent GDPR by blocking European users. However, if your colleague is running this site from outside of Europe, then Art 3(1) doesn't trigger.

  • Per Art 3(2), GDPR can apply to processing activities where there is no European establishment.

    There is the Art 3(2)(a) “targeting criterion”: if your colleague “offers” goods or services to people who are in Europe, regardless whether paid or gratis, then GDPR applies to all processing activities related to this offer. I'll discuss this more below.

    There is also the Art 3(2)(b) criterion: if your colleague monitors the behaviour of people that occurs in Europe, then GDPR applies. For example, an app collecting geolocation information or a website creating interest profiles for ad targeting might trigger this criterion.

    An IP block can help to establish that no offering/monitoring related to people who are in Europe is happening, but it might not be necessary.

It may be worth talking a bit more about the targeting criterion. The GDPR explicitly says that mere availability of a website in Europe doesn't imply that GDPR would apply. Instead, it is necessary to establish the data controller's intention – are they soliciting users from Europe, or otherwise expecting that people from Europe might use those services? Recital 23 gives a couple of non-exhaustive factors that can be considered here, for example:

  • the site uses a language or currency used in the EU but not used in the controller's own country
  • the site mentions users or customers from Europe, e.g. in testimonials

This means that a lot of US websites, written in English or Spanish, only mentioning payment in USD (if any), not mentioning any European countries, will not be subject to GDPR.

Then, occasional European visitors are irrelevant. It wouldn't be necessary to IP-block potential European users. However, such an IP-based block would help establish that the data controller really doesn't intend for those services to be offered to people who are in Europe. My personal opinion is that it's wasted effort to block users from foreign countries in case their foreign laws claim to apply, but if such a block brings peace of mind that might be worth it.

While geoblocking might not be necessary, is it sufficient? There is no clear guidance on this subject, but it seems to be generally accepted that IP-based geoblocking is fine, even though it is trivially circumvented using VPN services. Of course, if a website were to block European IP addresses but were to also advertise that people in Europe can use their services via VPNs, that would probably still be an “offer” and might defeat the point of doing any geoblocking.

The Art 3(1)(a) targeting criterion is most easily applied to things like ecommerce where physical goods are shipped to the customer in return for payment – so essentially whenever the data controller participates in the EU Single Market. This is roughly similar to the concept of a Nexus in US tax law. But in principle the targeting criterion can also apply to other kinds of websites or apps such as blogs, even if they are gratis. GDPR does not just apply to for-profit commercial activity, and doesn't distinguish between controllers that are entities/LLCs and controllers who are natural persons.

Things are slightly more complicated due to the Art 3(2)(b) monitoring criterion and the pervasive use of online trackers on websites, but this aspect of the GDPR is difficult to enforce and frequently ignored.

In this answer, “Europe” means the European Union (EU), the European Economic Area (EEA), and the United Kingdom (UK). Note that countries like Norway are covered by GDPR, whereas Switzerland is not. Of course, the GDPR is not the only privacy law relevant internationally.

1
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – feetwet
    Jul 18, 2022 at 17:28
14

As the answer by Dale M correctly points out, the GDPR imposes obligations on businesses. Individual users cannot release a business from such obligations, although they can choose not to file complaints. These obligations are enforced, not by privates suits by consumers or users of web sites, but by one or more of the various Data Protection Authorities (DPAs). A DPA may be moved by a complaint to take action, but no waiver could prevent a user from filing such a complaint.

Moreover, there are several state-level laws in the US already that impose obligations similar to those imposed by the GDPR. In addition to the well-known California Consumer Privacy Act (CCPA), there is the Colorado Privacy Act (takes effect 1 July 2023); the Connecticut Data Privacy Act (takes effect 1 July 2023); the Virginia Consumer Data Protection Act (takes effect 1 Jan 2023); and the Utah Consumer Privacy Act (takes effect 31 Dec 2023). All these include a right of access and a right of deletion similar to the ones provided by the GDPR. All include a restriction of data processing to specified purposes, again similar to the GDPR. Some include a limited private right of action (individual lawsuits). All of these have already passed the relevant state legislature and have been signed into law. There is also the California Privacy Rights Act, an enhanced version of the CCPA, which takes effect 1 Jan 2023.

Bills under active consideration include the Massachusetts Information Privacy and Security Act, the Michigan Consumer Privacy Act, the New Jersey Disclosure and Accountability Transparency Act, the Ohio Personal Privacy Act, and the Pennsylvania Consumer Data Protection Act. Bills have been introduced, but are not currently active, in some 23 other states

These laws and bills are summarized by the "US State Privacy Legislation Tracker" from IAPP (International Association of Privacy Professionals)

Thus, even if geoblocking is an effective strategy at the moment, it will not be one for long.


To respond to an issue raised in comments on the question, in case those get deleted: GDPR obligations will not be any different for a sole proprietorship as opposed to an LLC, and not much different for a large corporation. I don't see that an LLC will be much of an advantage for the sort of site the question discusses, but I can't see that it will do any harm, and the cost and effort are not large.

2
  • 1
    Thanks for the info; Wow, this approach of having a separate directive for every legal jurisdiction is not very feasible -- at least for an individual/small business.
    – Charles
    Jul 16, 2022 at 7:05
  • 5
    @Charles It can be a problem, especially for a small business. But that is how law often works. On all sorts of matters there are separate and often different laws in the various US states, the various EU countries, the different states of India, Provinces of Canada, and so on. On data protection it is not so bad, comply with the GDPR and one is in or close to compliance with all the above. Trademark registrations are all over the lot, even more so business licensing and tax laws.. Jul 16, 2022 at 14:28
10

The GDPR does not create rights, so there is nothing to waive

The GDPR places obligations on businesses, not rights on individuals. The difference is subtle but it means that there is nothing for an individual to waive.

The GDPR may apply to your friend’s undertaking notwithstanding

There are circumstances where the GDPR applies even if the business is not targeting Europe. Geolocation blocking may not be a sufficient mechanism to avoid this.

He has to do most of it anyway

California’s privacy laws are very similar to the GDPR. Since he has to comply with those he might as well go the whole hog.

6
  • "He has to do most of it anyway[:] California’s privacy laws are very similar to the GDPR" — is it clear that this website, described as a "personal venture" and a "free service", would meet any of the criteria to have those California laws apply to it?
    – user570286
    Jul 16, 2022 at 4:37
  • 1
    Thanks for the response. I had the same question @user570286 raised -- the links provided in these answers all make reference to businesses (vs. individuals) Before asking this question, I had suggested that my colleague register an LLC for this project. Perhaps that is not what he should do if he wants to avoid being classified as a business? In either case, this venture is not designed to make money.
    – Charles
    Jul 16, 2022 at 6:00
  • Whatever EU state's stance on blocking as not being sufficient is irrelevant, yes? The sovereign where the OP resides decides if the actions taken are sufficient.
    – paulj
    Jul 18, 2022 at 10:49
  • 2
    @paulj why on Earth would you think that? The GDPR is explicitly extraterritorial. They can come for you anywhere.
    – Dale M
    Jul 18, 2022 at 22:00
  • @DaleM Because the GDPR is EU only. Please link to the US treaty.
    – paulj
    Jul 20, 2022 at 19:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .