gdpr
On a mobile app, can I use IP location services to determine if a user is from EU prior to GDPR consent?
<p>I have a question about the GDPR law. I am creating a mobile application where I will need to store some personal data in order for the app to work. I would also like to include personalized ads in the app. Now if GDPR applies, I would need to get explicit consent from the user before showing personalized ads. However, here is my problem:</p>
<p>In order to know if GDPR applies to my user, I have to determine whether they are in the EU. I can do this by using a location API based on the user IP or by accessing some device settings. If I understand correctly, both ways would require prior GDPR consent of my user.  Can I access a user's location before they gave their GDPR consent? If not, how do I even know that I need their consent before asking them for it? It seems a bit like a chicken - egg problem to me.</p>

<p>Since you are from Europe, GDPR applies to <em>all</em> your processing activities per Art 3(1) GDPR, regardless of where the users are located. If you would like to avoid GDPR compliance, you would have to manage your business from abroad so that you no longer have an European establishment, and would have to avoid offering your services to people who are in Europe.</p>
<p>So let's assume that you have no European establishment. Then, GDPR can only apply per Art 3(2) to those processing activities that relate to offering goods or services to people who are in Europe. For determining this, IP-based geolocation is indeed common. Very likely, you do not need consent for this. GDPR does not require consent for everything, just a legal basis. There are six potential legal bases in Art 6(1), though the relevant ones are consent, necessity for performing a contract, legal obligations, and necessity for a legitimate interest. For things like security checks, it would be common to claim a legitimate interest.</p>
<p>Complying with GDPR can hurt revenue. However, data subjects have a right to data protection, but you do not have a right to a particular business model. Similarly, paying taxes can &quot;hurt revenue&quot;, but it's not really optional. If your business model can't deal with GDPR compliance (or with taxes), it might not be a sound business model.</p>
<p>In Europe, many newspapers have since moved from advertising-only to a consent-or-pay model. That is, the user is given a choice:</p>
<ul>
<li>You can read articles without tracking if you buy a subscription.</li>
<li>You can access articles for free if you consent to tracking.</li>
</ul>
<p>The legality of this is hotly debated. In principle, such an approach can be compliant, but the details are problematic, for example that you can only buy subscriptions rather than individual articles, and that these subscriptions are often orders of magnitude more expensive than what would be earned through ads. But this might actually be easier to solve for a mobile application than for a website, due to the availability of in-app payment and micropayment infrastructure.</p>
<p>In any case, GDPR limits how much you can &quot;encourage&quot; consent – per Art 7(4), you cannot make access to your service conditional on consent. There must be a way to use your app without consenting to anything, unless that consent is actually necessary for the app to work. For example, consenting to camera access is necessary for a QR code reader app to work. It is extremely unlikely that ads would be necessary in this sense. Users also must not suffer detriment for declining or withdrawing consent. From this, the EDPB has developed the concept of &quot;permissible incentive&quot; in their <a href="https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en" rel="noreferrer">guidelines on consent</a>.</p>
<p>In this post, &quot;Europe&quot; means EU/EEA/UK as appropriate.</p>

<p>I will assume you provide your app through a EU appstore of either Google or Apple or Amazon. That means you are doing business in the juristiction covered by the GDPR.</p>
<p>First, the GDPR protects &quot;EU citizens and residents&quot;. My citizenship status does not change, just because I use an internet connection with an end-IP somewhere else in the world.</p>
<p>So checking my IP to roughly guess my country is legally already somewhat fickle, but using my IP to guess my <em>citizenship</em> is really not a good idea.</p>
<p>The solution to your chicken and egg problem is to just grant <em>every</em> user the rights that you have to grant <em>some</em> of them. Problem solved. With zero extra effort on your side. You have to program it anyway, why create extra work for you by having specific cases for non-GDPR users.</p>
<hr />
<p>But to get into some details: sending the IP address to a third party service to guess my country is against the GDPR. So is using Google fonts on Google servers, to cite an actual example decided in court, because they too, get my IP address when I download them and I did not consent. If you want to use fonts, you have to host them on your own server and not give my private data to others. Based on that decision, I would say if you could determine my country based on IP <em>on your own machine</em> without giving my IP to someone else, that <em>might</em> work. I did not give you my IP for that specific purpose, but you don't store it... legally, a lawyer might figure out the details here. I think nobody would complain if you used it to guess my language for example.</p>
<p>But again: law is not about guessing. Just get your user's consent, that way you are in complicance with the GDPR and users not covered by it will certainly not complain about giving them the extra courtesy.</p>

<p>Even within their own country an EU resident or citizen may have an IP address pointing outside that country. For example for years I had a UK based ISP, while living in the Netherlands. I had an IP address placing me in Edinburgh, Scotland while I actually was in Amsterdam. I've also worked for a US company that had all internet traffic routed through their US datacenter, for the outside world I was located in Houston, Texas while sitting in my Amsterdam office. Using that IP address to check whether to apply GDPR rules to me would have led to the wrong decision.
And then there's the issue of VPNs. Using a VPN you can spoof your actual location using effectively the same mechanism I was subjected to, routing your data through a different location with a different IP range, thus masking your actual location (but in this case deliberately rather than as a side effect of your connection's implementation).</p>
<p>So even if it were legally enough to use technological means to determine someone's location, using an IP address won't be good enough as the IP address reported may not reflect the ACTUAL location of the person accessing your service.</p>
