Do I need a cookie policy/cookie consent on my website just because I use PayPal buttons? I'm building a website, and the only third party element in it is a PayPal button I use for payments. The PayPal button opens a pop-up window which has its own cookie consent banner. Does that mean I also need a cookie policy/cookie consent banner on my website? Other than that, I save the clients' billing information in the database, which I assume means I need at least a privacy policy, but I don't understand if I need a cookie consent banner just for that PayPal button.
You need a privacy notice for any website (if you're subject to GDPR). Having a PayPal button alone does not trigger such an requirement, since any website is already processing personal data such as IP addresses even if there's no third party content. But it's good that you think about issues for including third party content. As rulings such as the Fashion ID case and the more recent Google Fonts judgement have clarified, you are responsible having a suitable legal basis when you cause visitor's personal data to be disclosed to third parties. Even just embedding/loading a button or logo can cause personal data such as IP addresses to be disclosed to the recipients. You might have a legal basis if earlier, the user already opted in to payment with PayPal (could be consent per Art 6(1)(a) GDPR, or necessity for performing the contract per Art 6(1)(b)). Loading the embedded content just because the user might want to use it is probably not compliant though. For example, the common PayPal donation button is problematic. Thus, instead of linking a PayPal SDK, you might want to host the code + assets for the PayPal payment functionality on your own servers, or only load the PayPal content after the user unambiguously indicated that they want to use this content. I've discussed the PayPal donate button previously, as well as background on the Fashion ID case and click-to-consent wrappers for embedded content. What the Fashion ID case made very clear though is that you're only responsible for compliance for those data processing activity where you can actually influence the “purposes and means” of processing. You have no control over what PayPal does with the data on their servers, so they are solely responsible for that. And if the PayPal button navigates to a PayPal website, you're not responsible for what cookies PayPal sets on its own website. It is thus correct that the PayPal popup has its own cookie banner – you are not responsible for the contents of the popup. You also don't need to collect consent for cookies and similar technologies that are strictly necessary to provide a service that was explicitly requested by the user. For example, session cookies, XSRF protection cookies, and cookies containing a shopping cart are often such strictly necessary cookies. You must still be transparent about the use of such cookies, but you probably don't need a banner to announce this. So I think that you can probably go without a cookie banner, though you should probably get consent before loading PayPal content into your page, and you will likely want to be transparent about cookies as part of your privacy notice.
According to Josh Aas, Internet Security Research Group (ISRG) Executive Director, (the umbrella 501(c)(3) for Let's Encrypt): "It is not against our terms to charge for services using our certificates, though we'd strongly prefer that HTTPS just be part of every offering as a default with no additional fees." My host sells SSL letsencrypt certificates - Help - Let's Encrypt Community Support That said, what your old company is doing is charging for their time and expertise (aided possibly by their own automated software they developed) to install SSL certificates for their own webhosting customers on their own servers. The company is not reselling the SSLs; they are selling the service of installing the certificates. It's not easy to install and automate the updating of 90-day SSLs from Let's Encrypt. So what your old company is doing is making it easy - for a fee - for their customers to use a somewhat difficult to use free service with the rest of their paid webhosting. The customers are not getting any information about what certificate they are buying. That could be. Check the TOS and information that each customer gets when they use the webhosting service with an SSL from Let's Encrypt. Many customers may only be concerned with if the SSL works, or not. And I'm sure the webhosting company does not divulge all aspects of their services to their customers, especially concerning security of their webservers and other business systems.
I'm curious to know, because Google allowed their ownership of the domain to expire, why do they still have the rights to it even when it was bought by another individual. You're making an incorrect assumption here. The domain was never allowed to expire. An error in Google's domain registration interface allowed him to make an order for the domain. The domain was never actually purchased, but the act of ordering the domain gave Mr. Ved access to the domain in Google's Webmaster Tools. As the domain was never actually available for purchase, Mr. Ved had no rights to it. (The domain is not even registered through Google's domain registration interface; it's under a completely separate company, MarkMonitor, that specializes in high-value domains.)
It is not obvious that it violates the TOS (which is a complex wall of text and links to chase). §3 states that &quot;we need you to make the following commitments&quot;, followed by some subsections – you can re-interpret this as an agreement on your part to do this stuff. Those subsections relate to &quot;legitimate accounts and users&quot; (not relevant), &quot;what you can do&quot; (potentially relevant), &quot;permissions you give&quot; (granting them license to use your stuff), not infringing on their copyright. The second subsection about what you can &quot;do&quot; says that you can't &quot;violate these or other terms&quot;, or do anything unlawful, or infringing, nor may you upload viruses, or scrape Facebook data. So it turns out that there is nothing specific in that subsection, but it does say that you won;t violate &quot;other terms&quot;. §5 presents a bunch of other possible terms and policies: Community Standards, Commercial Terms, Advertising Policies, Self-Serve Ad Terms, Facebook Pages, Groups and Events Policy, Meta Platform Terms, Developer Payment Terms, Community Payment Terms, Commerce Policies, Meta Brand Resources, Music Guidelines and Live Policies. Those primarily apply to advertisers, group-pages, developers, commercial use and content broadcast via Meta. Community Standard applies to everybody, and as you should predict there is a long list of specific sub-categories such as &quot;Violence and Criminal Behavior&quot;, &quot;Safety&quot;, &quot;Objectionable Content&quot;, &quot;Inauthenticity&quot; etc. You would have to hire a lawyer to do an exhaustive search and interpretation. However, it appears that using an ad blocking app is not forbidden on FB, and that seems to be what that extension is. But you should read it for yourself. All. Of. It. It may have violated the older TOS, but that clause seems to me missing from the present TOS.
If the website containing the GDPR-wall processes any personal data of users who hit the GDPR-wall, the GDPR applies to that website. This can be as simple as writing a logfile of all visits to the website. In this case it will be illegal if the website owner does not comply with the GDPR. However a supervisory authority would probably not spent any time on such a minor violation. As long as the the website with the GDPR-wall does not process any personal data, the GDPR does not apply, so nothing in the GDPR can forbid the GDPR-wall. Some related remarks: The GDPR does not require a "privacy policy" on the website if the website does not process any personal data. If personal data is processed based on consent, that consent must be freely given. Also it may not be disruptive. So a cookie wall asking for consent would be illegal. But the GDPR does not care about any other disruptive popups, as long as they are not related to asking for consent. Using GeoIP is a perfect way to implement such a GDPR-Wall, because it would block everyone from within the EU, but nobody else. So it blocks exactly those for who the GDPR would apply. In such a case it would not be reasonable to expect anything more from a website owner. A user which uses a proxy, can not expect to be protected by the GDPR, because it bypasses a restriction set by the owner of the website. A webserver does use the IP-address of all incoming requests, to send the reply back. That could be considered a processing of personal data, but everybody seems to agree it is not. I am not sure why. But I do agree that it would be very impractical if that is considered processing of personal data. I added an example from the Washington Post So you have to pay $9/month for a GDPR compliant subscription. Because the price you have to pay is not unacceptable high, I think it would be valid to offer the premium version this way. This does not force you to choose one of the other subscriptions. In december 2018, the Austrian DPA (DSB) has confirmed that a similar offer is lawful. On derstandard.at you get a choice between free access with tracking and advertising, or pay 6 Euro/Month for tracking free access. Because 6 Euro/Month is cheaper than subscribing to the printed edition, the DSB accepted that as a valid choice. More information can be found on noyb.eu or, (with more details but in German), on wbs-law.de.
You will need to obtain permission from the company whose logo you intend to use before using it. Just because you use a product from that company in your devices doesn't necessarily give you permission to use their logo. Many companies have co-marketing plans that you can apply to be a part of but generally you and your product must meet certain requirements in order to be a part of it.
IANAL, and as @GeorgeBailey suggests, you should ask one. That said, some aspects of your question are directly addressable with what we know. Does US law states anything about this? Yes. Federally this falls under the Wiretap Act, 18 U.S.C. §2511. Workplace monitoring generally falls under either the "System Administrator Exception" or under Consent. In general, continuing past a banner constitutes consent. Does company policy enforcement with such a warning over ride the right to not be subject to surveillance? In general, yes. You don't need to use the companies network if you don't want to consent - and they don't need to hire you if you don't want to use their network. But it's their network, and their rules apply. There are some nuances, and courts have found that the wording of the notice has made a difference in some cases, but overall, if the systems are properly posted with banners, then the employer may capture communications. See the "Bannering and Consent" section of this article from cybertelecom.org, e.g.: Even if no clicking is required, a user who sees the banner before logging on to the network has received notice of the monitoring. By using the network in light of the notice, the user impliedly consents to monitoring pursuant to 18 U.S.C. § 2511(2)(c)-(d). Note that stored data is covered by different laws than communications. It's a nuance. Is it ethical to sniff all the data without giving any other warning than the logon banner? "Ethical" is a very different question than "Legal", and largely more subjective. Most employers require signed consent for monitoring as a condition of employment, and use banners thereafter. That is ethical by my definition, in that it meets or exceeds the requirements of the law, and does not mislead or use subterfuge. The tone of your question suggests you find it distasteful, and therefore probably it violates your personal code of ethics.
Probably Terms and Conditions extract: 7.2 Limitations on Closing Your Account. You may not close your Account to evade an investigation. If you attempt to close your Account while we are conducting an investigation, we may hold your funds for up to 180 Days to protect PayPal or a third party against the risk of Reversals, Chargebacks, Claims, fees, fines, penalties and other liabilities of whatever nature. You will remain liable for all obligations related to your Account even after the Account is closed. 10.6 Information about you a. PayPal reserves the right to request additional information from you, other than what is referred to in this Agreement, to allow it to comply with its anti-money laundering obligations. You agree to comply with any request for further information as we reasonably require to enable us to comply with our anti-money laundering obligations. This may include, without limitation, requiring you to fax, email or otherwise provide to us certain identification documents. You also agree to provide us, upon our reasonable request and at your own expense, information about your finance and operations, including, without limitation, your most recent financial statements (certified or otherwise) and merchant processing statements (if applicable). This is the contract that you agreed to be bound by.