3 ms·
You're right - Article 3 of GDPR defines the scope as applying to any user residing in the EU. If the users are not logged in then you don't know where they re
by bduerst 8y ago
You're right - Article 3 of GDPR defines the scope as applying to any user residing in the EU. If the users are not logged in then you don't know where they reside (IP address != residence), meaning any international company that operates in the EU needs to err on the side of caution for non-logged in users everywhere.
- jefftk 8y agoIP address geolocation is the normal way people determine if GDPR applies.
- bduerst 8y agoIP address geolocation is not always accurate, can be spoofed, and is flat out wrong for EU residents who travel outside of the EU. Maybe it's normal for a startup, but for a billion dollar company, they're not going to roll the dice on 4% revenue fines and IP address geolocation.
- jefftk 8y agoIf you send some test requests to any big company including Google I believe you'll see they're using IPgeo. (Disclosure: I work at Google, I'm not a lawyer, and this is not legal advice)
- user17843 8y agoDo you think my interpretation of Google not having long-term user-profiles of non-logged in users due to GDPR is correct? I read that Google has rolled out their GDPR compliance worldwide.
- bduerst 8y agoSimply using an IPGeo service doesn't mean they're not handling the GDPR compliance differently.