3 ms·
You're still the controller b/c you control the website they landed on. Presumably the user was trying to interact with you (as the website) and you get to say
by michaelbuckbee 8y ago
You're still the controller b/c you control the website they landed on. Presumably the user was trying to interact with you (as the website) and you get to say what does or does not go on to it.
It really all does revolve around control: as the website owner you can't control their ISP, Browser, VPNusage, etc. but you could trivially change your site from using Google Analytics to using a different system (or disable it altogether).
- Silhouette 8y agoYou're still the controller b/c you control the website they landed on. But the regulations don't say anything about websites. Being a controller is about whether you determine the purposes and means of processing (even if someone else is then doing that processing). Merely embedding third party content on your site doesn't even give you knowledge of that processing, never mind any control over it. Now, if you have a formal agreement with some other service that they will process personal data for some purpose and you will embed something in your page that gives them access to that data, obviously in that situation you're acting as controller. But huge amounts of the embedding that happens in the real world don't have those formal arrangements, and if you say no-one can ever embed anything any more without formal legal agreements to protect themselves, you break a large part of the modern web both technically and culturally. I don't think that was the intent of the new regulations, nor do I think it is a reasonable thing to do.