3 ms·

This might not be a great long term strategy, I'm expecting one or two buzzfeed-like websites to be put up against the wall and shot over this. I've always deal

This might not be a great long term strategy, I'm expecting one or two buzzfeed-like websites to be put up against the wall and shot over this. I've always dealt with the cookie notifications by using ublock to simply block that element, I never click "ok". I've never had a website actually stop me from using it when I do this until google changed their search page a few weeks ago. If you're running a website with one of these, I strongly suggest you make sure you record whether people accept and actually boot them off the site of they don't. GDPR article 7 section one requires a website to be able to demonstrate that I have given consent, and recital 32 requires that that consent be specific and unambiguous. It's doubtful that "by continuing to use this site you agree..." statements will be satisfactory, especially if you start the tracking the instant they hit the page, before they can click that ok button.

downandout 8y ago
I've always dealt with the cookie notifications by using ublock to simply block that element, I never click "ok". I've never had a website actually stop me from using it when I do this until google changed their search page a few weeks ago. I imagine that you simply won't be able to use websites anymore if you are from the EU and don't give consent. You'll just be told to go away.
- Sir_Substance 8y ago
  It's trickier than that for the website owner. EU citizens accessing websites through VPN's are still protected by GDPR.
  - downandout 8y ago
    In that case, you won't have any reason to believe that they are an EU citizen unless and until they indicate otherwise, and there are provisions within the GDPR for it not to apply in those cases where you are not intentionally obtaining data from EU citizens. On my sites that don't get alot of EU traffic anyway, I'm simply blocking EU IPs, and on all registration forms, I've removed EU countries from the country selection for residence, and put a notice that says "You may not register for this website if your country is not listed above".
    - Sir_Substance 8y ago
      >there are provisions within the GDPR for it not to apply in those cases where you are not intentionally obtaining data from EU citizens. I read the entire document a few weeks back and recall no such provisions. Could you cite one for me? I'm trying to be as informed on this as possible. Article 3, "Territorial scope", lays out where GDPR applies, and it contains no derogations for "but I didn't know they were european, honest". It is not, in fact, specifically about european citizens. It covers the processing of data for "natural persons in the Union", which is a bit unclear to me but I interpret it as covering anyone physically located in a country that forms a Supervisory Authority under section 51. How this will ultimately interact with your websites and/or businesses if you are not based in the EU is unclear at this time.
      - downandout 8y ago
        It's a massive document so I'm not going to go through and find it, but here's an interpretation of what I'm talking about [1]: "The reach of GDPR is broad but is not unlimited. The mere fact that a U.S.-based website can be accessed in the EEA isn’t enough. If the company does not have a physical presence in the EEA, it must be determined whether that company engages in more than incidental contact with EEA residents." So if someone is going out of their way to mask the fact that they are from the EU, and you aren't otherwise seeking out EU users, you're not going to get in trouble for that. One issue I have with it though is that translation may trigger GDPR exposure, and since Spain is part of the EU, many sites aimed at Spanish speakers (but not aimed at the EU) may have this beast of a law apply to them. I operate a few sites that have Spanish content, so that is deeply troubling. [1] https://www.gtlaw.com/en/insights/2018/2/the-gdpr-deadline-looms-is-your-us-website-ready https://www.gtlaw.com/en/insights/2018/2/the-gdpr-deadline-l...
        jpetso 8y ago
        Given that there is an entire continent whose people speak mostly Spanish (and with the remaining Portuguese speakers vastly outnumbering the ones in Portugal, too), I don't believe that providing a service in Spanish will go far as evidence that you're targeting EU citizens specifically.
  - tpm 8y ago
    As are non-EU citizens while in the EU, in some cases, and possibly even non-EU citizens not in the EU while using a service centered on providing them with e.g. travel arrangements in the EU. As a lawyer specializing in GDPR recently told me. Even investigative data journalists are going to have a lot of fun with the consequences of GDPR if she's right.
- michaelmrose 8y ago
  "You'll just be told to go away." I thought that too was disallowed if the data you collect isn't required to provide said service.

downandout 8y ago

I've always dealt with the cookie notifications by using ublock to simply block that element, I never click "ok". I've never had a website actually stop me from using it when I do this until google changed their search page a few weeks ago. I imagine that you simply won't be able to use websites anymore if you are from the EU and don't give consent. You'll just be told to go away.

Sir_Substance 8y ago
It's trickier than that for the website owner. EU citizens accessing websites through VPN's are still protected by GDPR.
- downandout 8y ago
  In that case, you won't have any reason to believe that they are an EU citizen unless and until they indicate otherwise, and there are provisions within the GDPR for it not to apply in those cases where you are not intentionally obtaining data from EU citizens. On my sites that don't get alot of EU traffic anyway, I'm simply blocking EU IPs, and on all registration forms, I've removed EU countries from the country selection for residence, and put a notice that says "You may not register for this website if your country is not listed above".
  - Sir_Substance 8y ago
    >there are provisions within the GDPR for it not to apply in those cases where you are not intentionally obtaining data from EU citizens. I read the entire document a few weeks back and recall no such provisions. Could you cite one for me? I'm trying to be as informed on this as possible. Article 3, "Territorial scope", lays out where GDPR applies, and it contains no derogations for "but I didn't know they were european, honest". It is not, in fact, specifically about european citizens. It covers the processing of data for "natural persons in the Union", which is a bit unclear to me but I interpret it as covering anyone physically located in a country that forms a Supervisory Authority under section 51. How this will ultimately interact with your websites and/or businesses if you are not based in the EU is unclear at this time.
    - downandout 8y ago
      It's a massive document so I'm not going to go through and find it, but here's an interpretation of what I'm talking about [1]: "The reach of GDPR is broad but is not unlimited. The mere fact that a U.S.-based website can be accessed in the EEA isn’t enough. If the company does not have a physical presence in the EEA, it must be determined whether that company engages in more than incidental contact with EEA residents." So if someone is going out of their way to mask the fact that they are from the EU, and you aren't otherwise seeking out EU users, you're not going to get in trouble for that. One issue I have with it though is that translation may trigger GDPR exposure, and since Spain is part of the EU, many sites aimed at Spanish speakers (but not aimed at the EU) may have this beast of a law apply to them. I operate a few sites that have Spanish content, so that is deeply troubling. [1] https://www.gtlaw.com/en/insights/2018/2/the-gdpr-deadline-looms-is-your-us-website-ready https://www.gtlaw.com/en/insights/2018/2/the-gdpr-deadline-l...
      - jpetso 8y ago
        Given that there is an entire continent whose people speak mostly Spanish (and with the remaining Portuguese speakers vastly outnumbering the ones in Portugal, too), I don't believe that providing a service in Spanish will go far as evidence that you're targeting EU citizens specifically.
- tpm 8y ago
  As are non-EU citizens while in the EU, in some cases, and possibly even non-EU citizens not in the EU while using a service centered on providing them with e.g. travel arrangements in the EU. As a lawyer specializing in GDPR recently told me. Even investigative data journalists are going to have a lot of fun with the consequences of GDPR if she's right.
michaelmrose 8y ago
"You'll just be told to go away." I thought that too was disallowed if the data you collect isn't required to provide said service.