gdpr
GDPR Compliance - Tell EU users not to sign up
<p>I have a client that wants to approach GDPR compliance by simply putting a notice on his subscription forms along the lines of "Don't sign up, Europeans"</p>

<p>From what I gather about GDPR compliance, I'm pretty sure that won't pass muster.  Correct?</p>

<p>I'm not aware of any cases on point, but as a rule legal fig-leaves don't play well in court.</p>
<p>If the webmaster simply puts up a banner saying that EU residents are not permitted but takes no other action to exclude them, then that is going to be considered irrelevant. The webmaster is still very likely required to comply with the GDPR.</p>
<p>On the other hand if the webmaster takes other steps to exclude EU residents, such as using a geolocation service to block connections known to be in the EU, validating email addresses and blocking those from EU domains, and ejecting anyone who mentions that their residence is in the EU, then that is more likely to be seen as a good-faith attempt to avoid being subject to the GDPR. It will also have the practical effect of greatly reducing the number of actual EU residents. All these controls can be evaded, but it would be much harder for any data subjects to claim that they acted in good faith or that the webmaster acted in bad faith.</p>
<p>Note that validating an email address or logging an IP is itself processing of personal data, so anyone implementing such a system still can't ignore the GDPR completely, but it would greatly limit the scope and make it easy to delete any such data after a short time.</p>
<p>(Note: the term &quot;EU resident&quot; above is an approximation of the <a href="https://gdpr-info.eu/art-3-gdpr/" rel="nofollow noreferrer">territorial scope</a>).</p>

<p>You can't get qualified legal advice on an anonymous message board. If the client really wants to go ahead with this, he should consult a qualified lawyer. </p>

<p>That being said, the EU maintains that the GDPR applies worldwide as long as the data subject is in the EU. The enforcement of such worldwide jurisdiction might prove difficult, but see e.g. the Iran sanctions regime by the US for an extreme case.</p>

<p>I don't think such a notice can prevent users from becoming GDPR data subjects.</p>
