7

I have a question about the GDPR law. I am creating a mobile application where I will need to store some personal data in order for the app to work. I would also like to include personalized ads in the app. Now if GDPR applies, I would need to get explicit consent from the user before showing personalized ads. However, here is my problem:

In order to know if GDPR applies to my user, I have to determine whether they are in the EU. I can do this by using a location API based on the user IP or by accessing some device settings. If I understand correctly, both ways would require prior GDPR consent of my user. Can I access a user's location before they gave their GDPR consent? If not, how do I even know that I need their consent before asking them for it? It seems a bit like a chicken - egg problem to me.

Improve this question
3
  • 2
    1. Why use the whole IP address? 2. How reliable is your geolocation? 3. Is it affected by VPNs?
    – Lag
    May 2 at 11:08
  • I'm using one of many IP location services like ip-api.com 1. I thought the whole IP was required to get the location - is this incorrect? 2. As reliable as the APIs. I would expect them to be accurate unless a VPN or proxy is used. 3. at least in some cases yes
    – Nik
    May 2 at 11:56
  • 24
    Note that you could ask for consent (and apply other GDPR rules) from everybody regardless of where they are located. This kind of contagion is by design.
    – Gala
    May 3 at 5:42

3 Answers 3

Reset to default
27

Since you are from Europe, GDPR applies to all your processing activities per Art 3(1) GDPR, regardless of where the users are located. If you would like to avoid GDPR compliance, you would have to manage your business from abroad so that you no longer have an European establishment, and would have to avoid offering your services to people who are in Europe.

So let's assume that you have no European establishment. Then, GDPR can only apply per Art 3(2) to those processing activities that relate to offering goods or services to people who are in Europe. For determining this, IP-based geolocation is indeed common. Very likely, you do not need consent for this. GDPR does not require consent for everything, just a legal basis. There are six potential legal bases in Art 6(1), though the relevant ones are consent, necessity for performing a contract, legal obligations, and necessity for a legitimate interest. For things like security checks, it would be common to claim a legitimate interest.

Complying with GDPR can hurt revenue. However, data subjects have a right to data protection, but you do not have a right to a particular business model. Similarly, paying taxes can "hurt revenue", but it's not really optional. If your business model can't deal with GDPR compliance (or with taxes), it might not be a sound business model.

In Europe, many newspapers have since moved from advertising-only to a consent-or-pay model. That is, the user is given a choice:

  • You can read articles without tracking if you buy a subscription.
  • You can access articles for free if you consent to tracking.

The legality of this is hotly debated. In principle, such an approach can be compliant, but the details are problematic, for example that you can only buy subscriptions rather than individual articles, and that these subscriptions are often orders of magnitude more expensive than what would be earned through ads. But this might actually be easier to solve for a mobile application than for a website, due to the availability of in-app payment and micropayment infrastructure.

In any case, GDPR limits how much you can "encourage" consent – per Art 7(4), you cannot make access to your service conditional on consent. There must be a way to use your app without consenting to anything, unless that consent is actually necessary for the app to work. For example, consenting to camera access is necessary for a QR code reader app to work. It is extremely unlikely that ads would be necessary in this sense. Users also must not suffer detriment for declining or withdrawing consent. From this, the EDPB has developed the concept of "permissible incentive" in their guidelines on consent.

In this post, "Europe" means EU/EEA/UK as appropriate.

Improve this answer
1
  • Comments have been moved to chat; please do not continue the discussion here. Before posting a comment below this one, please review the purposes of comments. Comments that do not request clarification or suggest improvements usually belong as an answer, on Law Meta, or in Law Chat. Comments continuing discussion may be removed.
    – feetwet ♦
    May 3 at 15:40
13

I will assume you provide your app through a EU appstore of either Google or Apple or Amazon. That means you are doing business in the juristiction covered by the GDPR.

First, the GDPR protects "EU citizens and residents". My citizenship status does not change, just because I use an internet connection with an end-IP somewhere else in the world.

So checking my IP to roughly guess my country is legally already somewhat fickle, but using my IP to guess my citizenship is really not a good idea.

The solution to your chicken and egg problem is to just grant every user the rights that you have to grant some of them. Problem solved. With zero extra effort on your side. You have to program it anyway, why create extra work for you by having specific cases for non-GDPR users.

But to get into some details: sending the IP address to a third party service to guess my country is against the GDPR. So is using Google fonts on Google servers, to cite an actual example decided in court, because they too, get my IP address when I download them and I did not consent. If you want to use fonts, you have to host them on your own server and not give my private data to others. Based on that decision, I would say if you could determine my country based on IP on your own machine without giving my IP to someone else, that might work. I did not give you my IP for that specific purpose, but you don't store it... legally, a lawyer might figure out the details here. I think nobody would complain if you used it to guess my language for example.

But again: law is not about guessing. Just get your user's consent, that way you are in complicance with the GDPR and users not covered by it will certainly not complain about giving them the extra courtesy.

Improve this answer
21
  • 1
    A law that claims to apply to everyone anywhere in the world who interacts with the citizen of some country, regardless of their locations, seems highly problematic even before the suggestion that everyone in every country should comply with the law in all cases just in case. Imagine these hypotheticals: (1) Russia passes a law saying that it is illegal to tell any Russian citizen that the invasion of Ukraine is a war. (2) The United States passes a law saying that the First Amendment to the US constitution (or worse, the Second!) applies to American citizens in Europe or anywhere else.
    – Obie 2.0
    May 2 at 8:22
  • 1
    That's assuming that your interpretation that the law applies to citizens outside of Europe is correct, which I am not sure about, since the people who drafted the law must have foreseen the obvious problems with this approach. And indeed, the page on its application outside the EU only seems to contemplate situations in which at least one party is within the EU.
    – Obie 2.0
    May 2 at 8:28
  • 5
    If the downvote and comments belong together: I am not sure what you expect from me. I did not make the law. I did not force the user to do business inside a juristiction that enforces this law either. I can explain their duties to the best of my ability. And I can suggest a literally zero cost solution that is legal. Not sure what else you expect from a good answer here.
    – nvoigt
    May 2 at 8:33
  • 3
    See examples 1 and 3 here. I think your answer is wrong in two aspects: the assertion that the GDPR applies to EU citizens outside the EU in general, and the assertion that if the app is available in the EU, then the GDPR automatically applies.
    – Obie 2.0
    May 2 at 8:34
  • 4
    @Obie2.0 indeed, it seems problematic in the sense that you don't exactly know who you're not allowed to spy on, and they made it that way on purpose, because they really don't like spying and don't think being in another country is a good excuse to do it. If you want to rely on them not having jurisdiction to sue you, that's your own risk as a business.
    – user253751
    May 3 at 1:42
2

Even within their own country an EU resident or citizen may have an IP address pointing outside that country. For example for years I had a UK based ISP, while living in the Netherlands. I had an IP address placing me in Edinburgh, Scotland while I actually was in Amsterdam. I've also worked for a US company that had all internet traffic routed through their US datacenter, for the outside world I was located in Houston, Texas while sitting in my Amsterdam office. Using that IP address to check whether to apply GDPR rules to me would have led to the wrong decision. And then there's the issue of VPNs. Using a VPN you can spoof your actual location using effectively the same mechanism I was subjected to, routing your data through a different location with a different IP range, thus masking your actual location (but in this case deliberately rather than as a side effect of your connection's implementation).

So even if it were legally enough to use technological means to determine someone's location, using an IP address won't be good enough as the IP address reported may not reflect the ACTUAL location of the person accessing your service.

Improve this answer
1
  • In Tarifa and Gibraltar (Europe) your mobile might automatically switch to a provider in Morocco (Africa).
    – Lag
    May 4 at 15:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .