11

The context of my question comes from this comment:

The problem with solving GDPR compliance with country codes is, it is not in general sufficient to determine if a user is covered by the GDPR. The GDPR requires you to comply with certain practices for data pertaining to people who are citizens or residents of EU countries. it doesn't specify that you only have to comply if their computer or IP address reports an EU country code. I as a European permanent resident could be using a US computer terminal at an internet cafe at the moment to log in to an account. That doesn't automatically mean my data aren't protected by the GDPR.

To give even more context, until I read this, I was under the impression that "GDPR banners" only need to be presented to users within the European Union/within regions with GDPR laws. Here is my reply to their comment:

I'm really surprised to hear this. The GDPR FAQ (is this official?) says it applies to "anyone in EU territory." Their What is GDPR page says it applies to organizations that "target or collect data related to people in the EU." Cookiebot charges extra to conditionally show their banner based off of location (maybe that's only [useful] for CCPA). Do you have an official source for your statement?

Is their interpretation correct?

I want to know the technically correct answer and the "in practice" answer; bear with me on this example of the difference (if this is super confusing, please ignore it. My main question is the previous paragraph):

Let's suppose I'm technically correct and I only have to show banners to people in GDPR regions. VPNs could hypothetically make that irrelevant because VPNs can change your IP address, allowing someone physically in the EU to have an IP address of someone outside the EU. If I need to present these VPN users with a banner, I have no choice but to show the banner to everyone: I'll have no way of knowing what region their IP address comes from.

Let's suppose the company of the website is in California.

20
  • 2
    The first linked comment is incorrect. The GDPR says absolutely nothing about citizenship.
    – phoog
    Sep 28 at 21:55
  • 17
    The GDPR does not require a banner at all, that's just an admission by the website operator that they do not have a good reason to be collecting this data, and would like the user's permission to do it anyway. If you run an e-commerce site, you are allowed to process customer identity information such as name and address in the context of an order without ever displaying a banner, because it is widely understood that sending a parcel requires this information, creating legitimate interest until the order has been completed. Sep 29 at 11:21
  • 1
    None of the existing answers are truly correct; the missing piece is whether the EU even has jurisdiction or not. An EU citizen connecting does not give the EU jurisdiction of itself any more than an Iranian citizen connecting to YouTube gives Iran jurisdiction over YouTube.
    – Joshua
    Sep 29 at 15:58
  • @Joshua - you leave one small tidbit unsaid: if the company (in your example, Google, Youtube, or Alphabet) has a presence in that country, they can be legally pressured into compliance. Even if they don't, they can lose revenue from ad announcers in those countries.
    – Mindwin
    Sep 29 at 18:46
  • @Mindwin: Rather I focused my comment to companies that are likely to read law.stackexchange.com and believe the answers (that is, really small ones).
    – Joshua
    Sep 29 at 18:54

4 Answers 4

27

Your VPN scenario is why you have to show the banner to everyone. If you somehow knew beyond any doubt that someone was not in the EU, then you would not have to show a banner, but because you can't verify that, you should always show the banner. Doing so also protects against accidentally violating a similar law in another country; the GDPR is the best-known privacy law, but it is far from the only one. It's good practice to ask for people's permission before collecting their information anyway.

7
  • 12
    I think this overstates the scope of the GDPR, and the other answers here are more nuanced – Art 3(2)(a) GDPR might not even trigger, since mere availability of a website to EU users doesn't imply GDPR applies. “Always show the banner” is of course safe and many sites do that, but the GDPR itself does not require it. GDPR only requires that you take appropriate measures to ensure compliance (see Art 24). Even though it will miss some cases, I think that IP-based geolocation is already a pretty good approach, in the sense that it can be reasonably defended in court if someone challenges it.
    – amon
    Sep 29 at 9:01
  • 2
    @amon meanwhile you're footing the bill for defense, which will most likely fall apart as soon as a counselor asks 'is there a guaranteed correlation between IP address and current physical location' and discovery finds that you are in fact holding identifying information of an EU located party without informed consent, or worse, that you aren't recording consent at all.
    – user46592
    Sep 29 at 12:43
  • 1
    It is possible that a court would find the GDPR to not apply to those using non-EU VPNs, but until a court rules in that way, better safe than sorry. Once you've put in the effort to be compliant, you might as well give everyone the option; I'm not in a jurisdiction with strong online privacy laws, but I appreciate being able to opt out of tracking. It's good to give users the option even if you don't legally have to.
    – Someone
    Sep 29 at 15:17
  • 1
    @Nohbdy is an "appropriate" measure defined as one that is correct 100% of the time?
    – user253751
    Sep 29 at 16:06
  • @user253751, that would be up to the judge or jury after listening to counselors making their arguments, whose time you will pay for when opposing counsel clearly demonstrates that you engaged in willful ignorance to collect data without informed consent from regulated persons. The failure mode of your question depends on somebody else's opinion, and the whole situation is entirely avoidable. If you can clearly demonstrate that you did show the notification, you might even be able to get damages. If you're going to hedge bets, pick bets with better failure modes.
    – user46592
    Sep 29 at 17:22
14

The answer by user Someone is correct, the GDPR applies to data associated with anyone physically in the EU, UK, or other places with a GDPR law. The comment quoted in the question is incorrect on this point: citizenship is irrelevant to the GDPR. An EU citizen connecting while physically located in the US is not covered for that session.

But there are other conditions not mentioned in the answer by Someone. According to Article 3 of the GDPR, it applies only if the Data Controller (DC) "offers goods or services" with the EU (or UK or other relevant region) or "monitors the behavior" of natural persons in the EU or UK (or other relevant region, I will just write EU for the rest of this answer). That is interpreted to mean that the DC advertised in the EU, or presented pages in an EU language different from that in the DC's country, or otherwise showed intent to appeal to EU residents. Merely being accessible from the EU does not constitute "targeting". So a DC that makes no effort to appeal to EU residents is probably not covered by the GDPR.

But Someone was correct that it is good practice to ask all users for consent. In addition to the GDPR, there is the CCPA which applies to data collected from or about any resident of California, wherever that resident is currently located. There are somewhat similar laws in Colorado and several other US states, mostly newer and less publicized than the GDPR. One of these laws might well apply when the GDPR does not. Certainly one cannot reliably determine whether the GDPR applies to a particular site visitor based on the IP address used, and the GDPR cares only about the visitor's physical location, not the IP address.

17
  • So a DC that makes no effort to appeal to EU residents is probably not covered by the GDPR. What does "not covered" mean? Does that effectively mean, "GDPR can be ignored?" Let's say Bob's website uses Google analytics and no other third party service. The data is used for two purposes: as a form of feedback to improve the site, and to catch bugs that may not be noticed otherwise. The site is only in English. Does Bob require consent under GDPR? Sep 29 at 1:48
  • 1
    @Daniel Kaplan There is not enough info in your comment for a reasonable conclusion about Bob's site. First, does the GDPR apply at all. It is not clear if Bob is targeting any part of the EU. If not, GDPR will not apply. Second, the purposes you mention might fit under "legitimate interest". If so consent is not needed to be GDPR compliant. By "not covrtrf" I meant "GDPR does not apply at all, in acord with Art 3, Sep 29 at 2:00
  • 4
    @Daniel Kaplan I am well aware of my many typos. I make efforts to correct them. I have always been a poor typist, but in recent years vision issues have made this much worse. Feel free to notify me of remaining errors or edit to fix them, as you please. Sep 29 at 2:04
  • 1
    @DanielKaplan In an unrelated answer, I recently went through an analysis whether GDPR might apply to a website per Art 3(2). The answer summarizes relevant factors, and links to relevant EDPB guidelines on this matter. Patreon auto-converting currencies is tricky though, and there are concerns this could cause GDPR to apply. (The link goes to a Reddit discussion providing important context, original article here).
    – amon
    Sep 29 at 9:11
  • 1
    CCPA applies only to some for-profit businesses that do business in California. Essentially, you either need to be large enough to matter or to make most of your money selling user data. I'm not sure this is really comparable to the GDPR.
    – doneal24
    Sep 29 at 18:04
2

You said, in a comment, that you may be asking the wrong question. I think a better way to put it would be that your question based on a confusion that is extremely common, so it deserves a clear answer.

From a European perspective, there are two different pieces of legislation at work.

(Rather than link directly to the legislation, I have linked to the Wikipedia pages from where you can find the legislation if you need it)

ePrivacy

The popup banners you see are aimed at compliance with Article 5(3) of the ePrivacy directive.

What the ePrivacy directive says

Article 5 begins:

Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia, about the purposes of the processing.

Cookies count as storing information on the equipment of a user, and requesting cookies counts as "gaining access". The default rule is that you may not do this without informed prior consent by the user.

There is an exception for essential cookies:

This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.

Here "essential" really means what it says. Google Analytics, while useful, really isn't essential and so any use of it had better obtain prior consent. The ePrivacy directive imports its definition of "consent" from the GDPR, so they mean the same thing (see recital 17).

By the way, for a long time you used to see "we care about your privacy" style popups that would allow you to say "yes" but if you wanted to say "no" you had to go through and select the cookies you did not want. This breaks a general rule of GDPR consent that consent should be as easy to refuse as to a give. "Yes" and "no" should be the same level of work.

Where does this apply?

So, now to the question I think you are asking. Where does this apply? The directive itself does not give us much detail. It says (in article 3):

This Directive shall apply to the processing of personal data in connection with the provision of publicly available electronic communications services in public communications networks in the Community, including public communications networks supporting data collection and identification devices.

I have emboldened the most crucial part.

Clearly, you have to at least have an electronic communications service and it must be available over a public communications network in the EU ("the Community"). But does that apply if my website just happens to be visible in the EU?

As far as I know, there's no direct authority on this point - in other words no case law. The European Data Protection Board ("EDPB") whose job it is to oversee the GDPR have given it some thought -see Internal EDPB Document 04/2021 on criteria of territorial competence of supervisory authorities to enforce Article 5(3) of the ePrivacy Directive. Their view is that it may depend on the law of the nation state in question (eg German law might come to a different decision than French law).

The proposed ePrivacy Regulation would clarify all this to some extent, though arguably in a more Draconian fashion. If this answer hangs around for a few years, that will become relevant.

In short: it is not particularly clear. If a service targets people in the EU as customers, I suspect that would fall within the directive. Otherwise I am not sure.

GDPR

Where does the GDPR apply?

The GDPR does have clear rules on jurisdiction. If you process personal data - where "process" includes storage etc - then there are four ways that you can come within the scope of the GDPR:

  • That processing happens "within the context" of an establishment in the EU. For example, you have subsidiary with offices there which sells advertising that appears on your website (to pick an example from Google Spain). This possibility does not depend on where the data subjects are or whether they are European or no.
  • If a controller isn't established in the EU, but offers goods or services to data subjects in the EU.
  • If a controller isn't established in the EU, but monitors the behaviour of data subjects in the EU
  • If a controller, rather than being in the EU, is somewhere that the law of a member state applies as a matter of International Law (eg a ship or perhaps a spacecraft under the Outer Space Treaty).

Do I need a consent banner under the GDPR?

Other than for ePrivacy compliance? No.

Well, to be pedantic, it might be possible to conceive of some such situation, but it would be very unlikely to happen in practice.

To amplify, the GDPR imposes a number of conditions on processing. One of these is that a controller must process "lawfully".

"Lawfully" obviously includes "not breaking the law", so if you breach the ePrivacy directive by not putting up a cookie banner and those cookies are also personal data, which would be common, then you also infringe the GDPR.

But the GDPR also says that "lawfully" includes a requirement to have what is known as a "lawful basis" for processing. Article 6 provides a short list of these.

One of these is "consent". The GDPR strongly discourages over-reliance on consent. For example, consent must be properly informed; it must be properly informed; and it must be freely given. This is very different from life under the data protection directive and I have spent a lot of time since 2018 (when the GDPR came into force) explaining to clients that they could nor, or should not, try to use consent as their lawful basis.

The two bases that usually apply are one that involves a contract between the data subject and the controller (if a controller contracts to supply a service to a data subject, that will involve processing personal data and will be lawful provided it is necessary) and a catch-all "legitimate interest". Google successfully relied on "legitimate interest" in the Google Spain case.

The thing is that a banner can just about allow someone to meaningfully decide whether they want non-essential cookies or not, though it can be tough to get that right, but not the complex processing that is typical in a more complicated relationship. Sure, you can point to a privacy notice or set of terms, but they are unlikely to be read or studied at the point when you need consent, even if data subjects can (and trust me they do) go back and read them later.

And "you may not use our service unless you consent..." does not sound like consent. Any "or else" works against the freedom of consent. This is why GDPR consent banners are (1) almost certainly useless and (2) almost never used. I have certainly never seen one.

3
  • Thanks for writing this thorough response! The GDPR strongly discourages over-reliance on consent. Maybe I missed it, but what's the alternative? Honestly, that's not my main question; my main question is, "If one uses Google analytics and stores no other data, what actions do they have to take to comply with all these laws?" "All these laws," is probably too vague a term for this site, but a webmaster isn't too concerned if they broke law or another, they just want to know how to not break the law. Is there a way for a webmaster to cover all their bases at once? Oct 2 at 4:49
  • 1
    I think I did mention that for most purposes you would use either legitimate interest or necessary for performance etc of a contract, depending on the data. Google analytics would be legitimate interest. You'd have to show that it passed the legitimate interest test; declare it in your privacy notice; and worry about whether Google analytics is specifically problematic (and it may be) but maybe a question focussed on analytics is a better place for that, since it covers many services. Oct 2 at 10:09
  • Thanks for the help, once again. I'll try to write that as a question soon. Oct 2 at 23:47
0

Depends on your own location

The first question is about your own location. If you (as a data controller or processor) are located within EU, then GDPR applies for any and all processing of personal data you do, no matter who is the data subject.

If you are located outside of EU then the relevant part of GDPR is Article 3.2 about territorial scope:

This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

So if the section applies (i.e. you're offering goods or services or monitoring behavior of these people) then the key criterion is whether these people are "in the Union". IP address might be a way to establish that, however, you may have more relevant information (e.g. address of the user or self-indicated location) in which case you should respect that even if the IP address is located outside of EU.

12
  • 4
    The IP address is never a good way to establish if a person is "in the union. At best it gives a fair first estimate. There will be both false positives and false negatives using geolocation from IP addresses. Sep 29 at 0:30
  • 8
    IP addresses are not a valid way to determine location. They can be changed with VPNs. A German user could easily visit a site with a California IP, for example, by using a VPN provider located in California. (Edit: I began typing before @DavidSiegel posted his comment.)
    – Someone
    Sep 29 at 0:31
  • 1
    @Someone: It's correct that VPN's make it hard to determine the actual location of the user. But there's no jurisprudence yet whether this matters. There is a counter-argument that VPN users can be considered to be outside the EU, like tourists. This is especially the case since VPN's these days offer a choice of originating IP. That German VPN user voluntarily chose to appear American.
    – MSalters
    Sep 29 at 7:50
  • 3
    @Someone Non-VPN IP addresses are fairly reliable for country-level attribution, which is probably enough for compliance purposes. The CJEU was asked about IP geolocation for compliance in C-131/12 but declined to rule on that aspect due to procedural reasons, though its comments suggest that they might be good enough. A data controller can address VPN concerns by treating all known VPN IP addresses as EU-located. These aspects of GDPR are not black and white, a reasonable effort already goes a long way. GDPR does not intend to force its rules upon purely foreign matters.
    – amon
    Sep 29 at 8:51
  • 7
    @Someone Is the site responsible for knowing the user's actual location if the user takes active steps to lie about their location? Common sense would suggest no, probably not
    – user253751
    Sep 29 at 16:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.