gdpr
What does &quot;monitor the behavior of individuals in the EU&quot; mean?
<p><a href="https://www.truevault.com/blog/do-i-need-to-be-gdpr-compliant.html" rel="nofollow noreferrer">https://www.truevault.com/blog/do-i-need-to-be-gdpr-compliant.html</a></p>
<blockquote>
<p>GDPR was created by the European Union to protect its citizens, and so it only affects organizations with some kind of relationship with the EU or its people. That said, it does not only apply to companies based in an EU country. According to Article 3, you will be affected if you are a data controller or data processor and any of the following apply:</p>
<ul>
<li>you are established in the EU (or somewhere else subject to EU law), or</li>
<li>you offer goods or services to individuals in the EU, or</li>
<li>you <strong>monitor the behavior of individuals in the EU.</strong></li>
</ul>
</blockquote>
<p>What does the last point here, &quot;monitor behaviour of individuals in the EU&quot;, mean?</p>
<p>Let's say, for basic functionality of a website, some rudimentary use of cookies is required to make the UI function as expected. Would that amount to &quot;monitoring behaviour&quot;, because some UI state information might be saved in cookies?</p>

<p>The text from Article 3 of <a href="https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&amp;from=EN" rel="nofollow noreferrer">the regulation</a> is:</p>
<blockquote>
<ol start="2">
<li>This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:</li>
</ol>
<p>(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or</p>
<p>(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.</p>
</blockquote>
<p>Article 3 is about the scope of the regulation. This particular question is clarified by <a href="https://gdpr-info.eu/recitals/no-24/" rel="nofollow noreferrer">Recital 24</a> (emphasis added).</p>
<blockquote>
<p>1 The processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union should also be subject to this Regulation when it is related to the monitoring of the behaviour of such data subjects in so far as their behaviour takes place within the Union. 2 In order to determine whether a processing activity can be <strong>considered to monitor the behaviour of data subjects</strong>, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes.</p>
</blockquote>
<p>The point of all this is that if you are collecting data about someone who is currently in the EU then the GDPR applies to you, regardless of where you are. The &quot;currently in the EU&quot; bit is significant: the GDPR doesn't apply if you collect data about the activities of an EU citizen who happens to be currently in the US, but it does apply to a US citizen who is visiting the EU. The term &quot;behaviour&quot; is used to distinguish data about what someone is currently doing from static data such as date and place of birth (which is presumably much more tied to nationality than current location).</p>
<p>Based on this recital, it seems unlikely that some functional cookies constitute &quot;monitoring&quot;. If the cookies are only used for short-term functionality then you can make sure of this by giving the cookies a short expiry date or making them <a href="https://en.wikipedia.org/wiki/HTTP_cookie#Session_cookie" rel="nofollow noreferrer">session cookies</a>.</p>

<p><a href="http://www.privacy-regulation.eu/en/recital-30-GDPR.htm" rel="nofollow noreferrer">Recital 30</a> mentions the use of Cookies, stating:</p>

<blockquote>
  <p>(30) Natural persons may be associated with online identifiers
  provided by their devices, applications, tools and protocols, such as
  internet protocol addresses, cookie identifiers or other identifiers
  such as radio frequency identification tags.</p>
  
  <p>This may leave traces which, in particular when combined with unique
  identifiers and other information received by the servers, may be used
  to create profiles of the natural persons and identify them.</p>
</blockquote>

<p>So the answer is "it depends what the cookies do".  If the cookies are used to track the user or there movement through the site then it would most likely fall foul of the law (if not disclosed).  If its very generic and not used for tracking purposes you are probably OK.</p>

<p>It may be noteworthy that - as I understand it - Recitals are used for interpretation and guidance, but are not the actual regulation.   According to 
<a href="https://www.privacy-regulation.eu/en/index.htm" rel="nofollow noreferrer">this</a> link recital 30 is relevant to Article 4 (Definitions) which does not actually mention cookies.</p>
