GDPR: Can I use an IP-address to show country pop-up without consent?
<p>I've a question. We would like to show a pop-up to users outside Europe to inform them we also have an American website as soon as they visit the website. We check the location based on their IP-address. We don't store the IP in a cookie or a session, just to show the pop-up.</p>
<p>Is this possible without the consent of the user?</p>
<p>Thanks in advance!</p>

<p>Under <a href="https://gdpr-info.eu/art-6-gdpr/" rel="noreferrer">GDPR Article 6</a> section 1(f), a lawful basis for processing is:</p>
<blockquote>
<p>processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.</p>
</blockquote>
<p>It seems that informing a data subject of the availability of a possibly better-focused related site would be a &quot;legitimate interest&quot;, and merely doing a broad geo-locate on the IP does not seem to impact the &quot;interests or fundamental rights and freedoms of the data subject&quot; so it would seem this could be done without specific consent in advance. I don't know of any legal case on this specific point, however.</p>

<blockquote>
<p>Can I use an IP-address to show country pop-up without consent?</p>
</blockquote>
<p>Yes. The answer posted by David Siegel is accurate, but another reason is that <em>country</em> clearly is insufficient data for identifying a natural person. See article 4(1) of the <a href="https://eur-lex.europa.eu/eli/reg/2016/679/oj" rel="nofollow noreferrer">GDPR</a>.</p>
<p>Even if coupling it with other data leads to identification (see preamble 30), it is obvious that <em>country</em> contributes negligibly or not at all toward identifying a natural person. It is the other information which materially enables identification.</p>

gdpr