GDPR &amp; Blocking EU Visitors?
<p>I recently chatted with a colleague who is preparing to launch a social networking and forum website which targets a relatively narrow audience (for discussion, let's say it is a dating site that solicits personal information to help find potential matches.)</p>
<p>He was primarily asking for my feedback on his technical design (which I provided), but I also noted he is planning to blacklist/block ALL connections from the EU due to GDPR regulation. His terms of service also prohibit users from connecting from any EU jurisdiction :(</p>
<p>Anyways, this project is his personal venture. He's open to anyone in the world using the service, but is excluding EU because he just doesn't want to deal with any of the legal headaches/uncertainty from GDPR. (Apparently many US media outlets [and others] which presumably have large legal teams have taken the same mass-blocking approach...)</p>
<p>Still, blocking a potentially useful free service from the entire EU just feels so regressive/anti-collaborative to me.  If I lived in the EU, I would be pretty ticked to be blanket-excluded from services that I may otherwise choose to use.</p>
<p>Does anyone know if there is a way for users in the EU to waive their GDPR rights in order to use a non-GDPR compliant website? (I suspect not, but just wanted to check whether there was a way to avoid a GeoIP &amp; TOS access block?)</p>
<p>The service will be hosted in the US and replicated via CloudFlare's Content Distribution Network.</p>
<p>Edit: Thanks for everyone's answers and comments. I posted another follow-up question:</p>
<p><a href="https://law.stackexchange.com/questions/82310/why-is-the-onus-for-adhering-to-privacy-directives-e-g-gdpr-ccpa-etc-on-a">Why is the onus for adhering to privacy directives (e.g. GDPR, CCPA, etc.) on a host and not the user?</a></p>

<p>If GDPR applies, then no one can opt out. If it doesn't apply, then an IP block is superfluous.</p>
<p>Whether GDPR applies is determined by Art 3 GDPR. For this, we must distinguish where the data controller is operating from. It is irrelevant where the site is hosted, but primarily relevant where the data controller (your colleague) has an “establishment”, e.g. where he resides or typically works from.</p>
<ul>
<li><p>Per Art 3(1), GDPR applies to all processing activities in the context of an European establishment, regardless of where the users are.</p>
<p>So if your colleague were running this site from Europe, they wouldn't be able to circumvent GDPR by blocking European users. However, if your colleague is running this site from outside of Europe, then Art 3(1) doesn't trigger.</p>
</li>
<li><p>Per Art 3(2), GDPR can apply to processing activities where there is no European establishment.</p>
<p>There is the Art 3(2)(a) “targeting criterion”: if your colleague “offers” goods or services to people who are in Europe, regardless whether paid or gratis, then GDPR applies to all processing activities related to this offer. I'll discuss this more below.</p>
<p>There is also the Art 3(2)(b) criterion: if your colleague monitors the behaviour of people that occurs in Europe, then GDPR applies. For example, an app collecting geolocation information or a website creating interest profiles for ad targeting might trigger this criterion.</p>
<p>An IP block can help to establish that no offering/monitoring related to people who are in Europe is happening, but it might not be necessary.</p>
</li>
</ul>
<p>It may be worth talking a bit more about the targeting criterion.
The GDPR explicitly says that mere availability of a website in Europe doesn't imply that GDPR would apply. Instead, it is necessary to establish the data controller's <em>intention</em> – are they soliciting users from Europe, or otherwise expecting that people from Europe might use those services? Recital 23 gives a couple of non-exhaustive factors that can be considered here, for example:</p>
<ul>
<li>the site uses a language or currency used in the EU but not used in the controller's own country</li>
<li>the site mentions users or customers from Europe, e.g. in testimonials</li>
</ul>
<p>This means that a lot of US websites, written in English or Spanish, only mentioning payment in USD (if any), not mentioning any European countries, will not be subject to GDPR.</p>
<p>Then, occasional European visitors are irrelevant. It wouldn't be necessary to IP-block potential European users. However, such an IP-based block would help establish that the data controller really doesn't intend for those services to be offered to people who are in Europe. My personal opinion is that it's wasted effort to block users from foreign countries in case their foreign laws claim to apply, but if such a block brings peace of mind that might be worth it.</p>
<p>While geoblocking might not be <em>necessary</em>, is it <em>sufficient</em>? There is no clear guidance on this subject, but it seems to be generally accepted that IP-based geoblocking is fine, even though it is trivially circumvented using VPN services. Of course, if a website were to block European IP addresses but were to also advertise that people in Europe can use their services via VPNs, that would probably still be an “offer” and might defeat the point of doing any geoblocking.</p>
<p>The Art 3(1)(a) targeting criterion is most easily applied to things like ecommerce where physical goods are shipped to the customer in return for payment – so essentially whenever the data controller participates in the EU Single Market. This is roughly similar to the concept of a Nexus in US tax law. But in principle the targeting criterion can also apply to other kinds of websites or apps such as blogs, even if they are gratis. GDPR does not just apply to for-profit commercial activity, and doesn't distinguish between controllers that are entities/LLCs and controllers who are natural persons.</p>
<p>Things are slightly more complicated due to the Art 3(2)(b) monitoring criterion and the pervasive use of online trackers on websites, but this aspect of the GDPR is difficult to enforce and frequently ignored.</p>
<p>In this answer, “Europe” means the European Union (EU), the European Economic Area (EEA), and the United Kingdom (UK). Note that countries like Norway are covered by GDPR, whereas Switzerland is not. Of course, the GDPR is not the only privacy law relevant internationally.</p>

<p>As the answer by Dale M correctly points out, the GDPR imposes obligations on businesses. Individual users cannot release a business from such obligations, although they can choose not to file complaints. These obligations are enforced, not by privates suits by consumers or users of web sites, but by one or more of the various Data Protection Authorities (DPAs). A DPA may be moved by a complaint to take action, but no waiver could prevent a user from filing such a complaint.</p>
<p>Moreover, there are several state-level laws in the US already that impose obligations similar to those imposed by the GDPR. In addition to the well-known California Consumer Privacy Act (CCPA), there is the Colorado Privacy Act (takes effect 1 July 2023); the Connecticut Data Privacy Act (takes effect 1 July 2023); the Virginia Consumer Data Protection Act (takes effect 1 Jan 2023); and the Utah Consumer Privacy Act (takes effect 31 Dec 2023). All these include a right of access and a right of deletion similar to the ones provided by the GDPR. All include a restriction of data processing to specified purposes, again similar to the GDPR. Some include a limited private right of action (individual lawsuits). All of these have already passed the relevant state legislature and have been signed into law. There is also the California Privacy Rights Act, an enhanced version of the CCPA, which takes effect 1 Jan 2023.</p>
<p>Bills under active consideration include the Massachusetts Information Privacy and Security Act, the Michigan Consumer Privacy Act, the New Jersey Disclosure and
Accountability Transparency Act, the Ohio Personal Privacy Act, and the Pennsylvania Consumer Data Protection Act. Bills have been introduced, but are not currently active, in some 23 other states</p>
<p>These laws and bills are summarized by the <a href="https://iapp.org/resources/article/us-state-privacy-legislation-tracker/" rel="noreferrer">&quot;US State Privacy Legislation Tracker&quot;</a> from IAPP (International Association of Privacy Professionals)</p>
<p>Thus, even if geoblocking is an effective strategy at the moment, it will not be one for long.</p>
<hr />
<p>To respond to an issue raised in comments on the question, in case those get deleted: GDPR obligations will not be any different for a sole proprietorship as opposed to an LLC, and not much different for a large corporation. I don't see that an LLC will be much of an advantage for the sort of site the question discusses, but I can't see that it will do any harm, and the cost and effort are not large.</p>

<h2>The GDPR does not create rights, so there is nothing to waive</h2>
<p>The GDPR places obligations on businesses, not rights on individuals. The difference is subtle but it means that there is nothing for an individual to waive.</p>
<h2>The GDPR may apply to your friend’s undertaking notwithstanding</h2>
<p>There are <a href="https://gdpr.eu/companies-outside-of-europe/" rel="noreferrer">circumstances</a> where the GDPR applies even if the business is not targeting Europe. Geolocation blocking may not be a sufficient mechanism to avoid this.</p>
<h2>He has to do most of it anyway</h2>
<p>California’s privacy laws are very similar to the GDPR. Since he has to comply with those he might as well go the whole hog.</p>

gdpr privacy