united-states internet gdpr international european-union
Do I need to present a GDPR banner to IP addresses outside of GDPR regions?
<p>The context of my question comes from <a href="https://webmasters.stackexchange.com/questions/140499/what-region-codes-require-gdpr-compliance?noredirect=1#comment197570_140499">this comment</a>:</p>
<blockquote>
<p>The problem with solving GDPR compliance with country codes is, it is not in general sufficient to determine if a user is covered by the GDPR. The GDPR requires you to comply with certain practices for data pertaining to people who are citizens or residents of EU countries. it doesn't specify that you only have to comply if their computer or IP address reports an EU country code. I as a European permanent resident could be using a US computer terminal at an internet cafe at the moment to log in to an account. That doesn't automatically mean my data aren't protected by the GDPR.</p>
</blockquote>
<p>To give even more context, until I read this, I was under the impression that &quot;GDPR banners&quot; only need to be presented to users within the European Union/within regions with GDPR laws. Here is <a href="https://webmasters.stackexchange.com/questions/140499/what-region-codes-require-gdpr-compliance?noredirect=1#comment197592_140499">my reply</a> to their comment:</p>
<blockquote>
<p>I'm really surprised to hear this. The <a href="https://gdpr.eu/faq/" rel="nofollow noreferrer">GDPR FAQ</a> (is this official?) says it applies to &quot;anyone <strong>in</strong> EU territory.&quot; Their <a href="https://gdpr.eu/what-is-gdpr/" rel="nofollow noreferrer">What is GDPR</a> page says it applies to organizations that &quot;target or collect data related to people <strong>in</strong> the EU.&quot; <a href="https://www.cookiebot.com/en/functions/" rel="nofollow noreferrer">Cookiebot</a> charges extra to conditionally show their banner based off of location (maybe that's only [useful] for CCPA). Do you have an official source for your statement?</p>
</blockquote>
<p>Is their interpretation correct?</p>
<p>I want to know the technically correct answer <em>and</em> the &quot;in practice&quot; answer; bear with me on this example of the difference (if this is super confusing, please ignore it. My main question is the previous paragraph):</p>
<p>Let's <em>suppose</em> I'm technically correct and I only have to show banners to people in GDPR regions. VPNs could hypothetically make that irrelevant because VPNs can change your IP address, allowing someone <em>physically</em> in the EU to have an IP address of someone outside the EU. If I need to present these VPN users with a banner, I have no choice but to show the banner to everyone: I'll have no way of knowing what region their IP address comes from.</p>
<p>Let's suppose the company of the website is in California.</p>

<p>Your VPN scenario is why you have to show the banner to everyone. If you somehow knew beyond any doubt that someone was not in the EU, then you would not have to show a banner, but because you can't verify that, you should always show the banner. Doing so also protects against accidentally violating a similar law in another country; the GDPR is the best-known privacy law, but it is far from the only one. It's good practice to ask for people's permission before collecting their information anyway.</p>

<p>The <a href="https://law.stackexchange.com/a/84824/17500">answer by user Someone</a> is correct, the GDPR applies to data associated with anyone physically in the EU, UK, or other places with a GDPR law.  The comment quoted in the question is incorrect on this point: citizenship is irrelevant to the GDPR. An EU citizen connecting while physically located in the US is not covered for that session.</p>
<p>But there are other conditions not mentioned in the answer by Someone. According to Article 3 of the GDPR, it applies only if the Data Controller (DC) &quot;offers goods or services&quot; with the EU (or UK or other relevant region) or &quot;monitors the behavior&quot; of natural persons in the EU or UK (or other relevant region, I will just write EU for the rest of this answer). That is interpreted to mean that the DC advertised in the EU, or presented pages in an EU language different from that in the DC's country, or otherwise showed intent to appeal to EU residents. Merely being accessible from the EU does not constitute &quot;targeting&quot;. So a DC that makes no effort to appeal to EU residents is probably not covered by the GDPR.</p>
<p>But Someone was correct that it is good practice to ask all users for consent. In addition to the GDPR, there is the CCPA which applies to data collected from or about <strong>any</strong> resident of California, wherever that resident is currently located. There are somewhat similar laws in Colorado and several other US states, mostly newer and less publicized than the GDPR. One of these laws might well apply when the GDPR does not. Certainly one cannot reliably determine whether the GDPR applies to a particular site visitor based on the IP address used, and the GDPR cares only about the visitor's physical location, not the IP address.</p>

<p>You said, in a comment, that you may be asking the wrong question. I think a better way to put it would be that your question based on a confusion that is extremely common, so it deserves a clear answer.</p>
<p>From a European perspective, there are two different pieces of legislation at work.</p>
<ul>
<li>The <a href="https://en.wikipedia.org/wiki/Privacy_and_Electronic_Communications_Directive_2002" rel="nofollow noreferrer">ePrivacy Directive</a></li>
<li>The <a href="https://en.wikipedia.org/wiki/General_Data_Protection_Regulation" rel="nofollow noreferrer">General Data Protection Regulation</a></li>
</ul>
<p>(Rather than link directly to the legislation, I have linked to the Wikipedia pages from where you can find the legislation if you need it)</p>
<h1>ePrivacy</h1>
<p>The popup banners you see are aimed at compliance with Article 5(3) of the ePrivacy directive.</p>
<h2>What the ePrivacy directive says</h2>
<p>Article 5 begins:</p>
<blockquote>
<p>Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia, about the purposes of the processing.</p>
</blockquote>
<p>Cookies count as storing information on the equipment of a user, and requesting cookies counts as &quot;gaining access&quot;. The default rule is that you may not do this without informed prior consent by the user.</p>
<p>There is an exception for essential cookies:</p>
<blockquote>
<p>This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.</p>
</blockquote>
<p>Here &quot;essential&quot; really means what it says. Google Analytics, while useful, really isn't essential and so any use of it had better obtain prior consent. The ePrivacy directive imports its definition of &quot;consent&quot; from the GDPR, so they mean the same thing (see recital 17).</p>
<p>By the way, for a long time you used to see &quot;we care about your privacy&quot; style popups that would allow you to say &quot;yes&quot; but if you wanted to say &quot;no&quot; you had to go through and select the cookies you did not want. This breaks a general rule of GDPR consent that consent should be as easy to refuse as to a give. &quot;Yes&quot; and &quot;no&quot; should be the same level of work.</p>
<h2>Where does this apply?</h2>
<p>So, now to the question I think you are asking. Where does this apply? The directive itself does not give us much detail. It says (in article 3):</p>
<blockquote>
<p>This Directive shall apply to the processing of personal data in connection with the provision of <strong>publicly available electronic communications services in public communications networks in the Community</strong>, including public communications networks supporting data collection and identification devices.</p>
</blockquote>
<p>I have emboldened the most crucial part.</p>
<p>Clearly, you have to at least have an electronic communications service and it must be available over a public communications network in the EU (&quot;the Community&quot;). But does that apply if my website just happens to be visible in the EU?</p>
<p>As far as I know, there's no direct authority on this point - in other words no case law. The European Data Protection Board (&quot;EDPB&quot;) whose job it is to oversee the GDPR have given it some thought -see <a href="https://edpb.europa.eu/our-work-tools/our-documents/internal-documents/internal-edpb-document-042021-criteria-territorial_nl" rel="nofollow noreferrer">Internal EDPB Document 04/2021 on criteria of territorial competence of supervisory authorities to enforce Article 5(3) of the ePrivacy Directive</a>. Their view is that it may depend on the law of the nation state in question (eg German law might come to a different decision than French law).</p>
<p>The proposed <a href="https://en.wikipedia.org/wiki/EPrivacy_Regulation" rel="nofollow noreferrer">ePrivacy Regulation</a> would clarify all this to some extent, though arguably in a more Draconian fashion. If this answer hangs around for a few years, that will become relevant.</p>
<p>In short: it is not particularly clear. If a service targets people in the EU as customers, I suspect that would fall within the directive. Otherwise I am not sure.</p>
<h1>GDPR</h1>
<h2>Where does the GDPR apply?</h2>
<p>The GDPR does have clear rules on jurisdiction. If you process personal data - where &quot;process&quot; includes storage etc - then there are four ways that you can come within the scope of the GDPR:</p>
<ul>
<li>That processing happens &quot;within the context&quot; of an establishment in the EU. For example, you have subsidiary with offices there which sells advertising that appears on your website (to pick an  example from Google Spain). This possibility does not depend on where the data subjects are or whether they are European or no.</li>
<li>If a controller isn't established in the EU, but offers goods or services to data subjects in the EU.</li>
<li>If a controller isn't established in the EU, but monitors the behaviour of data subjects in the EU</li>
<li>If a controller, rather than being in the EU, is somewhere that the law of a member state applies as a matter of International Law (eg a ship or perhaps a spacecraft under the Outer Space Treaty).</li>
</ul>
<h2>Do I need a consent banner under the GDPR?</h2>
<p>Other than for ePrivacy compliance? No.</p>
<p>Well, to be pedantic, it might be possible to conceive of some such situation, but it would be very unlikely to happen in practice.</p>
<p>To amplify, the GDPR imposes a number of conditions on processing. One of these is that a controller must process &quot;lawfully&quot;.</p>
<p>&quot;Lawfully&quot; obviously includes &quot;not breaking the law&quot;, so if you breach the ePrivacy directive by not putting up a cookie banner and those cookies are also personal data, which would be common, then you also infringe the GDPR.</p>
<p>But the GDPR also says that &quot;lawfully&quot; includes a requirement to have what is known as a &quot;lawful basis&quot; for processing. Article 6 provides a short list of these.</p>
<p>One of these is &quot;consent&quot;. The GDPR strongly discourages over-reliance on consent. For example, consent must be properly informed; it must be properly informed; and it must be freely given. This is very different from life under the data protection directive and I have spent a lot of time since 2018 (when the GDPR came into force) explaining to clients that they could nor, or should not, try to use consent as their lawful basis.</p>
<p>The two bases that usually apply are one that involves a contract between the data subject and the controller (if a controller contracts to supply a service to a data subject, that will involve processing personal data and will be lawful provided it is necessary) and a catch-all &quot;legitimate interest&quot;. Google successfully relied on &quot;legitimate interest&quot; in the Google Spain case.</p>
<p>The thing is that a banner can just about allow someone to meaningfully decide whether they want non-essential cookies or not, though it can be tough to get that right, but not the complex processing that is typical in a more complicated relationship. Sure, you can point to a privacy notice or set of terms, but they are unlikely to be read or studied at the point when you need consent, even if data subjects can (and trust me they do) go back and read them later.</p>
<p>And &quot;you may not use our service unless you consent...&quot; does not sound like consent. Any &quot;or else&quot; works against the freedom of consent. This is why GDPR consent banners are (1) almost certainly useless and (2) almost never used. I have certainly never seen one.</p>

<h2>Depends on your own location</h2>
<p>The first question is about your own location. If you (as a data controller or processor) are located within EU, then GDPR applies for any and all processing of personal data you do, no matter who is the data subject.</p>
<p>If you are located outside of EU then the relevant part of GDPR is Article 3.2 about territorial scope:</p>
<blockquote>
<p>This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:</p>
<p>(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or</p>
<p>(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.</p>
</blockquote>
<p>So if the section applies (i.e. you're offering goods or services or monitoring behavior of these people) then the key criterion is whether these people are &quot;in the Union&quot;. IP address might be a way to establish that, however, you may have more relevant information (e.g. address of the user or self-indicated location) in which case you should respect that even if the IP address is located outside of EU.</p>
