internet gdpr privacy data-protection
How to avoid having problem with data protection regulations (GDPR)?
<p>I would like to make an online platform, where the users can upload videos or link YouTube videos. Right now, I don't want to earn anything through this website (maybe in a couple of years, and by advertising, but absolutely not now). I use the YouTube Plugin to embed the videos in my website.
As the users can create accounts on my website, I need to include the &quot;privacy policies&quot; in my page.</p>
<p>I asked a lawyer to write this text for me and he did that. However, he warned me that using the YouTube Plugin may be problematic (even when I use YouTube in privacy enhanced mode) and is not necessarily in accordance with the data protecion rules in EU (I live in Germany).</p>
<p>As using this plugin is the heart of my website, I can't avoid using the plug in. Now, I would like to know how I can solve the problem.</p>
<p>To whom exactly do the data protection rules (DSGVO/GDPR) apply? My website would be &quot;.com&quot; (and not &quot;.de&quot;, I don't register any company for that in Germany and the website is in English and not necessarily for German. Why should the regulation apply to me? Just because I am living in Germany?</p>
<p>How can I avoid this problem? Should/Can I register a company in the USA? Isn't there any better way?!</p>
<p>Thanks in advance,</p>

<p>The answer is yes, the regulation applies to you because you are established in the EU (Germany is part of the EU, and a significant part of why the GDPR was established in the first place, so Germany as such does not change the situation). - <a href="https://gdpr-info.eu/art-3-gdpr/" rel="nofollow noreferrer">See art. 3, p 1</a></p>
<p>Even if you were established in the US, that wouldn't help as long as you process the data of Europeans.  - <a href="https://gdpr-info.eu/art-3-gdpr/" rel="nofollow noreferrer">See art. 3, p 2</a></p>
<p>Why would you want to go the length of establishing a US base just to meet a basic requirement for your website?</p>
<p>Now the problem is that the YouTube videos track users across the web, even in privacy enhanced mode (I think that's without cookies, if I remember well). The solution for that is to look around for CMPs, consent management platforms. With such a solution, you can get the users' informed consent for embedding content from YouTube.</p>
<p>I hope this helps!</p>

<h2>Don’t operate in the EU or UK</h2>
<p>The GDPR applies to the processing of “personal data of data subjects”, controllers and processors who are in the EU, but also to “processing activities” related to: (1) offering goods or services; or (2) monitoring data subject behavior that takes places in the EU. See GDPR Article 3(2).</p>
<p>If any of the users on whom you collect data are (or might be) in the EU (plus UK),  you cannot escape the GDPR.</p>

<p>Yes GDPR applies, no you can't make the law not apply to you. Much like taxes, data protection is not optional. Even if you were to create a foreign company, you'd be conducting business from Germany so all processing activities would be in the “context” of your German establishment and therefore fully subject to the GDPR.</p>
<p>But complying with GDPR might not be a big problem for you.</p>
<p>When embedding content from third parties, you need a “legal basis” why you're allowed to share personal data with that third party. For example, simply embedding a YouTube video necessarily shares personal data such as your user's IP addresses with YouTube.</p>
<p>The solution is to not load the embedded video until the user has given their consent, which is a legal basis per Art 6(1)(a) GDPR. Until then, show a placeholder for the video. This has been the standard approach for German websites for about a decade, and the importance of not embedding third party content was emphasized by the 2019 <em>Fashion ID</em> case at the CJEU and in 2022 by a case at the LG München relating to the use of Google Fonts. I discussed the <em>Fashion ID</em> case in <a href="https://law.stackexchange.com/a/56006/20476">this other answer</a> where I also link to a an <a href="https://www.verbraucherzentrale.de/wissen/digitale-welt/datenschutz/eughurteil-likebutton-von-facebook-nur-mit-info-an-nutzer-12029" rel="nofollow noreferrer">article by the Verbraucherzentrale</a> that shows an example of such a consent placeholder.</p>
<p>You should discuss the specific text on the placeholder with your lawyer. In line with a “layered” approach to transparency, the placeholder itself might only provide an essential summary and provide a link to more detailed information, e.g. as part of your privacy policy. For a discussion of which information is necessary in order to obtain valid consent, read the <a href="https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en" rel="nofollow noreferrer">EDPB guidelines on consent</a>, especially section 3.3.1 (paragraph 64).</p>
<p>Once the user has given their consent to load YouTube videos, you can remember that consent e.g. with a cookie so that you don't have to constantly ask them.</p>
