internet international gdpr
Excluding all people from the EU from my blog - is this allowed?
<p>There's a new law from the European Union I simply cannot comply with (GDPR).
Its way to complex, not even big companies can comply with it. I also don't know what google does with the data from my visitors.</p>

<p>If I let a checkbox pop up on every page that the users need to confirm they're not from the EU nor using the site from the EU, would it be fine?</p>

<p>Is it allowed to exclude people on that way?
Will I still be affected by the GDPR if I forbid all acces from people from the EU and acces from within the EU?</p>

<p>In a similar question I <a href="https://law.stackexchange.com/a/29369/18215">answered</a>:</p>

<blockquote>
  <p>As long as the the website with the GDPR-wall does not process any personal data, the GDPR does not apply, so nothing in the GDPR can forbid the GDPR-wall.</p>
</blockquote>

<p>But even if the GDPR would apply;</p>

<blockquote>
  <p>If personal data is processed based on consent, that consent must be freely given. Also it may not be disruptive. So a cookie wall asking for consent would be illegal. But the GDPR does not care about any other disruptive popups, as long as they are not related to asking for consent.</p>
</blockquote>

<p>You do not ask for consent, you simply ask for someone's location.</p>

<p>So if you place <em>a checkbox pop up on every page that the users need to confirm they're not from the EU nor using the site from the EU</em>, that would be fine provided you do not process any personal data before the popup is shown.</p>

<p>However, this might lead to <strong>everybody from the EU saying they are not from the EU</strong>. In that case, the checkbox has no meaning any more, so it won't work what you are trying to do. This would be expressed in existing laws, not the GDPR itself. Note that in Europe (as far as I know) laws are not explained literally as written down, but they will be explained as what they are trying to achieve. That is also why the GDPR has so many recitals, they explain how the binding articles have to be interpreted. (Note that criminal laws are an exception to what I just described).</p>

<p>In particular if your blog shows ads or content directed to visitors from the EU, it will be assumed the checkbox has no meaning. </p>

<p>But it should not really be difficult for a blog to comply to the GDPR. For things like google analytics a lot of documents exists explaining how you need to configure it to be GDPR compliant.</p>

<p>Making a wall to access your site is against the GDPR. Technically GDPR applies to everyone who runs a website and yes even brick and motar shops who ever deal with EU citizens.</p>

<p>Specifically the GDPR is a law for EU citizens personal data. So at any point if you collect personal data or track an EU citizen (ie analytics) then you are in the scope of the GDPR. Analytics can have its stored personal data (up address) anonomyzed. At which point you fall out of the GDPR scope as the IP address is no longer specific and thus not personal data. However if you use say the user id option of google analytics then that is then considered in scope of the GDPR.</p>

<p>Then you have the issue if the visitor can create an account. If you allow simply username and password as registration then you are not in scope of GDPR. However if you collect a name or an email than you are in scope of the GDPR.</p>

<p>The GDPR also addresses that you cannot provide a service in which consent is a requirement. In your case your consent is at the option of asking if they are an EU citizen or not. This would clearly violate the freely given consent clause in the GDPR.</p>
