3 ms·

Even GDPR does not require fresh consent for every new product and service. You have to have to update the privacy policy, inform users you're doing so, and let

• emn13 6y ago
  I don't believe there is such a no objection rule - or perhaps I'm looking at it from a different angle - can you be more specific? Products and services aren't the issue; it's how you use+process users' data. Many products and services don't materially affect that, so won't require additional consent (e.g. if you're a company that sends news-updates by email to users that opted in, I don't believe sending them other updates is a PII issue - course, it might be spam, and IANAL). Also, products and services you're explicitly contracted for are exempt anyhow (e.g. if the user is paying you to remind them to take their meds on time, you don't need additional GDPR consent to store and process their sensitive personal data to the extent necessary to fulfill that contract - though other laws almost certainly apply to medical data).
• luckylion 6y ago
  This isn't "a service" though, it's a different company (which LinkedIn owns). That's a third party with regards to GDPR, because, as it now happens, you can sell that company. If it was a LinkedIn-asset, that could look different (e.g. you can access YouTube with your Google Account created for GMail). But that would create another problem: if it was an asset (and not a company), you'd need opt-in from every user to transfer their user data over to the buyer, because the buyer would be a third party. It's either a company or an asset, it can't be both at the same time.