Is it possible to refuse offering service to GDPR-protected customers? Let's say I have a service that asks registration details from the user and for some reason I, as a provider of that service, can't comply to GDPR and therefore want to refuse registration of new users protected by GDPR or similar law. Is it possible to add a clause in the registration form requiring user to cancel registration of their new account if they are covered by GDPR (or, better, any similar law)? For simplicity let's assume that I don't have to worry about existing users. Update: I see similar question that seeks to achieve the same effect by means of introducing filters or by other disruptive means, this is different as it relies on EULA that user should accept before proceeding to use the website.
Yes, you could do this be means of the EULA, provided you are not in the EU yourself. You only have to comply with the GDPR if you are offering a product or service to people that are in the EU. If you are making it clear that whatever you offer is not available to Europeans, you make your site exempt from the GDPR.
The GDPR only require explicit (hard) consent if you use the cookie to store personal data. Given the conditions you cite, the data you store is not personal data, so this cookie does not require consent. In theory, someone having access to both session cookie and "analytics cookie" could relate the two, but that is highly non-trivial. You may have to do DPIA to demonstrate that this is non-trivial, or that you have mitigation in place to mitigate staff abusing such access. But provided things are as you say, the "analytics" cookie does not require consent.
is this even legal? It is legal, but at the same time the contract is voidable by you. This means that if the buyer rejects the EULA, he is entitled to return the unused product and be reimbursed. Obviously once the buyer has used the product, the conclusion will be that he accepted the EULA and therefore no longer can void the contract. The buyer's entitlement to rescind the contract compensates for the fact that he was not duly informed about the conditions prior to making the purchase.
The conditions for lawfulness of processing are spelled out in Article 6 of the GDPR. As for it being legal for website operators to log the IP-addresses of visitors, this is covered by the following paragraph (also pointed out by phoog in a comment). The paragraph says it is legal to process personal data if processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. (my emphasis) You are not the only web site that logs IP addresses for the purpose of security. Every web site I've ever worked on - from those controlled by large corporations to tiny NGOs - do this. This security practice will not be impacted by the GDPR (if it were, I am sure we would have heard about it by now). there is the EU cookie law too If your website are going to be accessible to European citizens and not only accessible by your friends and familiy, you have to comply with the EU cookie directive of 2002 (a exemption for "personal websites" does not exist).
IP addresses are personal data. That means you need a legal basis to process them, but not necessarily consent from the user. That IP addresses should be treated as personal data in most contexts is clear, regardless of whether you can associate the IP address with a user ID. That you make such an association affirms that both the IP address and user ID are personal data in your context though. As the answers in the questions you linked indicate, there are alternative legal bases to consent. The GDPR offers a choice of six legal bases (Art 6(1) lit a–f). In most cases, you would instead rely on a “legitimate interest” for logging. But it's not enough to claim that you have a legitimate interest. You must have a clear purpose for which such logs would be necessary, and you would then have to weigh this legitimate interest against the interests, rights, and freedoms of the affected data subjects. If such logs are necessary for security and anti-abuse purposes, your legitimate interest test is likely to prevail. However, you must limit retention of the logged data and the included information to what is actually necessary. For example, keeping user IDs in there might not be necessary. If the association of IP addresses and user IDs is not necessary for a legitimate interest, then you would indeed need consent. Discussion on why IP addresses are personal data. You see many answers and opinions that IP addresses might not be personal data. Some of these are technically correct, but most are misinformed or outdated. I know only a single well-informed person that still disagrees. For everyone else such as the EU Commission, IP addresses are clearly personal data. Under the GDPR, personal data is any information that relates to an (indirectly) identifiable natural person. In the context of log files we can assume that the entries usually “relate” to a person, namely the person making the request. The exception would be requests triggered by automated systems. The more interesting question is whether the person to which the log entry relates is identifiable. While the GDPR does provide further guidance on the concept of identification in Recital 26, it does not provide clear unambiguous criteria. Thus, there is lots of debate about what that precisely means. One approach is to sidestep that debate and and notice that the GDPR's definition of personal data explicitly notes that a person might be identified “in particular by reference to an identifier such as a name, an identification number, location data, an online identifier” (Art 4(1)). Another but otherwise unrelated part of the GDPR mentions “internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags” as examples of online identifiers (Recital 30). We can also look more deeply into Recital 26 and see that “singling out” already counts as identification. We can use the IP address to single out one person's log entries from the set of log entries, so this could be interpreted as meaning that any stable user ID renders the data personal data – and an IP address is sufficiently stable in this context. Another part of Recital 26 says that we must consider “all the means reasonably likely to be used” for identification, even if this involves additional information from third parties. This phrasing is virtually identical to the GDPR's predecessor, the EU Data Protection Directive. On the basis of that DPD, the EU's top court (ECJ/CJEU) was asked to rule on the question whether dynamic IP addresses are personal data (the Breyer case, C‑582/14, judgement from 2016-10-19). It said yes. “It did not say yes”, some people will object. And they are technically correct. When someone rents an internet connection from an ISP, the ISP will have logs that connect the user's real-world identity to the IP address they were assigned at a time. You don't have access to the ISP's logs. But, if that user violated your rights (e.g. a cyberattack or copyright infringement), then you could (depending on civil vs criminal matters) report this to the appropriate authorities or to petition the court and they would have the right to order the ISP to disclose this information. The CJEU said that if this chain (you → authorities → ISP → user identity) is grounded in law, then the IP address would be identifiable. But whether there are suitable laws to compel the ISP to disclose this data would be up to national laws, and the CJEU doesn't concern itself with that. Spoiler: such laws are pretty common. To summarize typical objections: The IP address doesn't relate to a person: Can be a valid objection, but is not typically the case for user-facing web services. The Recital 30 argument is not valid because it's about profiling, not identification, and it only says that IP addresses may be used for profiling, not that they are always identifying: Technically correct, but I think that Recital 30 merely expresses the implied understanding that of course an IP address is an online identifier and permits identification by itself. “Singling out” does not apply because SOME_REASON: Indeed, this is an ill-defined term with no case law to guide us. However, regulators such as the EDPB and their predecessor WP29 routinely use “singling out” to mean being able to distinguish one person's data from other people's data. An IP address lets us do that. The Breyer judgement is not applicable because the defendant in that case was the German state, and the state has other legal means than ordinary website operators: Nothing in that case was specific to the website operator being a state or other authority. If the website operator can contact the appropriate authority and if they have the right to order the ISP to disclose the relevant data, then the IP address is identifiable. The CJEU didn't say “yes” in Breyer, it said “if”. So I'll take that as a “no”: The CJEU concerns itself with the interpretation of EU law, not with national laws. Specifically in the Breyer case, lower courts confirmed that German law has the necessary means. In other EU member states, further checks would be necessary but it would surprise me if there wouldn't be equivalent subpoena powers. If the ISP doesn't have the data, then the IP addresses are anonymous: Indeed, the CJEU scenario collapses if there is no additional data to be linked with the IP address. However: The CJEU used this scenario as an example to show that IP addresses can be identifiable. If that particular scenario fails, there could be other scenarios that still allow identification. The question of whether IP addresses are identifiable had of course been the subject of wider debate at the time. That the GDPR explicitly mentions IP addresses can be seen as a reaction to this debate. Thus, in a sense, the Breyer case is moot. It is still useful as an explanation of how broad “reasonably likely means” must be interpreted.
First take a look at Article 13(1) of Directive 2002/58/EC Article 13 Unsolicited communications The use of automated calling systems without human intervention (automatic calling machines), facsimile machines (fax) or electronic mail for the purposes of direct marketing may only be allowed in respect of subscribers who have given their prior consent. Notwithstanding paragraph 1, where a natural or legal person obtains from its customers their electronic contact details for electronic mail, in the context of the sale of a product or a service, in accordance with Directive 95/46/EC, the same natural or legal person may use these electronic contact details for direct marketing of its own similar products or services provided that customers clearly and distinctly are given the opportunity to object, free of charge and in an easy manner, to such use of electronic contact details when they are collected and on the occasion of each message in case the customer has not initially refused such use. Note that this is a Directive, so it is not directly binding, but each EU member state has created it's own laws containing this. I also quoted paragraph 2 for completeness, but based on your description, it does not apply. Article 95 GDPR explicitly specifies it does not change any obligations from Directive 2002/58/EC. So it looks very clear to me the situation you describe is not legal. Article 14 GDPR allows you to request all information regarding this, which included information how they have exactly obtained your name and email address.
There is a lot going on in this question, so I'll pick out some individual aspects. Last but not least, I'll discuss if GDPR even applies. Does the GDPR require consent for X? Almost always, no. Consent is only one of many legal bases of processing. A common alternative to consent is a “legitimate interest” where a balancing test is performed between this legitimate interest and your interests, rights, and freedoms. Consent is typically only appropriate if this balancing test fails, for example if you would not reasonably expect this processing activity to occur. It's worth noting that it's a reasonably common occurrence that businesses are sold or merged. This is not unexpected. In general, you would not be required to consent to such a transfer. What can a company do with personal data acquired through a merger/acquisition? The GDPR does not provide explicit provisions for this case. But it might be useful to think about the two cases where (a) the new company is a continuation or successor of the original one, and (b) where the data is transferred (“sold”) to an otherwise unrelated company. In case (a) where the business is continued as normal, there is no change. In case (b) where data is transferred to a separate company, things are more complicated. The original company would need a legal basis for transferring the data. But as mentioned above, there might be a legitimate interest. Arguably, such a transfer could also be based on Art 6(1)(b) if the transfer is necessary to continue to provide the service, for example if the original company would otherwise have to terminate service. Of course, activities like data brokering where access to data is granted to unrelated third parties would generally fail to be covered by contractual necessity or a legitimate interest, and would probably need consent – but that doesn't seem to be the case here. When a data controller (such as the new company) acquires your personal data from sources other than directly from you, then they are subject to the notice requirements in Art 14. They have to actively notify you about their processing activities. But because you received emails that mentioned the transfer, this condition might have been met. Of course the new company continues to be bound by the purpose limitation principle as detailed in Art 6(4) – they can only use the data for purposes that are compatible with the purposes for which the data was initially collected. Thus, the new company cannot arbitrarily widen processing purposes, though some change in scope is certainly permissible. How does the GDPR right to object and to restrict processing apply here? The Art 21 GDPR right to object means that if the legal basis for a processing activity is a “legitimate interest”, then you can ask for an opt-out. But in some cases, this objection does not have to be granted. An objection essentially requires the controller to repeat the legitimate interest balancing test, taking into account the “grounds relating to [your] particular situation” that you provided in the objection. The Art 18 GDPR right to restrict processing is an alternative to the right to erasure. It applies only in narrow circumstances, for example while an objection is being checked. It is likely that you were informed about the transfer to a new company about 1 month in advance, so that you would have been able to prevent this transfer by closing your account prior to the deadline. If the new company conducts processing activities based on a legitimate interest, then their presumably GDPR-compliant privacy notice about which you were notified will certainly explain that you have a right to object. Is the new company GDPR-compliant? That is impossible to tell, but nothing you've shown so far indicates that they're non-compliant. My largest issue with this story is that the new company is from Australia, a country with extraordinarily bad privacy protections (as of 2022). However, due to the way how the GDPR treats international transfers of data, this doesn't prevent Australian data controllers from being GDPR-compliant, although it does make it difficult for other companies to use services based in Australia. Does GDPR even apply? Whether GDPR applies to a non-European company depends only on whether they either offer goods or services to people who are in Europe (“targeting criterion”), and whether the monitor people's behavior that takes place in Europe. Factors such as your citizenship would be irrelevant. I'll ignore the monitoring criterion, and focus on the targeting criterion. I'll assume that you are in Europe (EU/EEA or UK). Whether a company is targeting people in Europe depends primarily on the company's intentions. It does not matter whether the service is accessible from Europe. Thus, it is quite possible that the original company was not subject to the GDPR. Then, any questions about GDPR, consent, and data transfers are moot. In contrast, the new company clearly mentions GDPR-compliance, which would only matter if they intend for people in Europe to use their services. So GDPR probably applies to them, giving you the full suite of GDPR data subject rights as (hopefully) outlined in their privacy notice. And as long as they notified you that they acquired your personal data in accordance of Art 14, I don't seen anything that they might have done wrong in respect to this acquisition/merger.
Update: On 1 October 2019 the CJEU ruled in Case C‑673/17 (Verbraucherzentrale Bundesverband vs. Planet49 GmbH) that cookies require explicit consent regardless of personal data is being processed. (Where the exceptions don't apply). (paragraphs 68-70 of the ruling). That does probably invalidate my answer below. However, because I have based my answer on information provided by the Dutch DPA, I will not update my answer until that DPA has responded on this. 'By clicking agree or continuing to use this site you agree to our privacy policy' Neither of theses options is considered clear consent. Continuing to use the site, is implied consent, which is not sufficient. Also it does not give you the option to reject. Clicking agree to agree the privacy policy is not specific enough. You must offer a separate opt-in box for everything for which you need consent. The privacy policy is just a text in which you explain your privacy policy. It is not a contract which needs agreement. Also keep in mind that withdrawal of consent must be as easy as giving it. So you must be able to return to the settings and change them. Having said that, it is possible to configure Google Analytics in a way you don't need consent; Accept the Data Processing Amendment Go to Admin Choose Account Settings Scroll down to the data processing amendment Accept it Click Save Disable Data Sharing Go to Admin Choose Account Settings Scroll down to the data sharing settings Uncheck all checkboxex Click Save Disable Data Collection for Advertising Go to Admin Choose Account Settings Choose Property settings Choose Tracking info Choose Data collection Turn off these two options Click Save Disable the User-ID feature Go to Admin Choose Account Settings Choose Property settings Choose Trackinginfo Choose User-ID Turn off these options Click Save Anonymize your visitors IP Address Add { ‘anonymize_ip’: true } to the tracking code on your website Even though you don't need consent, you still need to add a few lines to your privacy policy: You are using Google Analytics cookies. You have a data processing agreement with google. You have enabled IP anonymization/masking. You have disabled data sharing. You are not using any other google services in combination with Google Analytics. The Dutch DPA has a more complete manual, but unfortunately it is not available in English.