4 ms·

One of the great things about GDPR is that this sort of thing will be flatly illegal. Want to use my IP address to look up information about me? Great, so long

One of the great things about GDPR is that this sort of thing will be flatly illegal. Want to use my IP address to look up information about me? Great, so long as you ask for, and get, my explicit consent.

no1youknowz 8y ago
I found some examples of consent (by Drip): https://i.imgur.com/QPzXiWN.png https://i.imgur.com/QPzXiWN.png https://i.imgur.com/KiX2aCc.png https://i.imgur.com/KiX2aCc.png Although time will tell. My gut tells me that users will click decline and without any negative consequences (a redirect) and the dialog simply closes. Users will get used to doing that for all other EU sites and these startups marketing efforts will suffer. Remember cookie law? Everyone I know is conditioned to click and not even look at the privacy policy. That means overall, less profits for marketing and then lost sales. It's going to be very interesting to see how competitive EU startups become verses US startups where in the US, GDPR doesn't exist (for now). That said as well. Where US startups have much greater profits for marketing to non-EU regions, and EU startups cannot compete again due to less revenue due to regulations. EU startups will shrink against their US counterparts. Again, all of this is my own speculation and lets see how things are in 2 years time. Very interesting times ahead.
- rhizome 8y ago
  I found some examples of consent (by Drip): Something tells me they collect more than "e.g. your name and email address."
- gschier 8y ago
  Drift*, not Drip
- pedalpete 8y ago
  Isn't most of this stuff just managed with UX? Do people click "no" on cookie messages? or just "dismiss" which I assume means "whatever, just get this box out of the way"..
- phn 8y ago
  From our experience, that consent screen is wrong under the GDPR. It asks for permission for 3 things, and while the first 2 could arguably be necessary for the "service", the third one (updates and promotions) clearly isn't. And it seems they refuse to provide service if you don't agree with everything in bulk. This would be akin to an airline declining to sell you a plane ticket if you don't enroll in their promotional newsletter. Flat out illegal under the GDPR.
imhoguy 8y ago
IANAL, but company lookup by IP/DNS shouldn't fall under GDPR [0]: "(14) The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence, in relation to the processing of their personal data. This Regulation does not cover the processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person." [0] http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2016.119.01.0001.01.ENG http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:O...
- c2h5oh 8y ago
  European Court of Justice ruling confirmed that IP address can be considered personally identifiable information if a party can lawfully obtain information linking it to a natural person
  - TomMarius 8y ago
    But that is not the case there. SaaS's typically don't target a natural person, they target businesses (in EU, self employment is considered business as well).
    - bigiain 8y ago
      That might work ok for Clearbit's customers - who can send an IP address and either get back a company name or nothing, but I suspect Clearbit have to have some solid legal advice for answers to questions like "What if a customer sends you a home/residential IP address?" I live alone - my ip address is (and has been for a decade or more) static. It without doubt will qualify as Personally Identifying Information.
      - TomMarius 8y ago
        This is actually very well defined. If the IP address (the contract with ISP to be specific - thus every IP it might provide to the user) is used for business purposes (doesn't matter how much), then it's regarded as business even though it's residential and the businessman lives there.
x0x0 8y ago
Not at all. If you're selling corporate targeted tools, you can assume that visitors represent a company and the lookup is a corporation. Facts about a company are not personal data per the GDPR. Note that a work email is certainly personal data, but the fact that a visitor works at corporation X isn't. As always, consult with your counsel. But that's what ours says.
- troydavis 8y ago
  Find new counsel. GDPR doesn’t consider the site’s intent at all, and the ECJ would - rightly - love to make an example of a company which “[assumed] that visitors represent a company” because they sell to companies.
  - x0x0 8y ago
    Believe whatever you want, but a legitimate interest to match ip to company on a corporate targeted page is well within bounds. And since you don't know what you're talking about, ok as per previous discussions with ICO.
- DanBC 8y ago
  https://ico.org.uk/for-organisations/marketing/the-rules-around-business-to-business-marketing-the-gdpr-and-pecr/ https://ico.org.uk/for-organisations/marketing/the-rules-aro...

no1youknowz 8y ago

I found some examples of consent (by Drip): https://i.imgur.com/QPzXiWN.png https://i.imgur.com/QPzXiWN.png https://i.imgur.com/KiX2aCc.png https://i.imgur.com/KiX2aCc.png Although time will tell. My gut tells me that users will click decline and without any negative consequences (a redirect) and the dialog simply closes. Users will get used to doing that for all other EU sites and these startups marketing efforts will suffer. Remember cookie law? Everyone I know is conditioned to click and not even look at the privacy policy. That means overall, less profits for marketing and then lost sales. It's going to be very interesting to see how competitive EU startups become verses US startups where in the US, GDPR doesn't exist (for now). That said as well. Where US startups have much greater profits for marketing to non-EU regions, and EU startups cannot compete again due to less revenue due to regulations. EU startups will shrink against their US counterparts. Again, all of this is my own speculation and lets see how things are in 2 years time. Very interesting times ahead.

rhizome 8y ago
I found some examples of consent (by Drip): Something tells me they collect more than "e.g. your name and email address."
gschier 8y ago
Drift*, not Drip
pedalpete 8y ago
Isn't most of this stuff just managed with UX? Do people click "no" on cookie messages? or just "dismiss" which I assume means "whatever, just get this box out of the way"..
phn 8y ago
From our experience, that consent screen is wrong under the GDPR. It asks for permission for 3 things, and while the first 2 could arguably be necessary for the "service", the third one (updates and promotions) clearly isn't. And it seems they refuse to provide service if you don't agree with everything in bulk. This would be akin to an airline declining to sell you a plane ticket if you don't enroll in their promotional newsletter. Flat out illegal under the GDPR.

imhoguy 8y ago

IANAL, but company lookup by IP/DNS shouldn't fall under GDPR [0]: "(14) The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence, in relation to the processing of their personal data. This Regulation does not cover the processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person." [0] http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2016.119.01.0001.01.ENG http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:O...

c2h5oh 8y ago
European Court of Justice ruling confirmed that IP address can be considered personally identifiable information if a party can lawfully obtain information linking it to a natural person
- TomMarius 8y ago
  But that is not the case there. SaaS's typically don't target a natural person, they target businesses (in EU, self employment is considered business as well).
  - bigiain 8y ago
    That might work ok for Clearbit's customers - who can send an IP address and either get back a company name or nothing, but I suspect Clearbit have to have some solid legal advice for answers to questions like "What if a customer sends you a home/residential IP address?" I live alone - my ip address is (and has been for a decade or more) static. It without doubt will qualify as Personally Identifying Information.
    - TomMarius 8y ago
      This is actually very well defined. If the IP address (the contract with ISP to be specific - thus every IP it might provide to the user) is used for business purposes (doesn't matter how much), then it's regarded as business even though it's residential and the businessman lives there.

x0x0 8y ago

Not at all. If you're selling corporate targeted tools, you can assume that visitors represent a company and the lookup is a corporation. Facts about a company are not personal data per the GDPR. Note that a work email is certainly personal data, but the fact that a visitor works at corporation X isn't. As always, consult with your counsel. But that's what ours says.

troydavis 8y ago
Find new counsel. GDPR doesn’t consider the site’s intent at all, and the ECJ would - rightly - love to make an example of a company which “[assumed] that visitors represent a company” because they sell to companies.
- x0x0 8y ago
  Believe whatever you want, but a legitimate interest to match ip to company on a corporate targeted page is well within bounds. And since you don't know what you're talking about, ok as per previous discussions with ICO.
DanBC 8y ago
https://ico.org.uk/for-organisations/marketing/the-rules-around-business-to-business-marketing-the-gdpr-and-pecr/ https://ico.org.uk/for-organisations/marketing/the-rules-aro...