If website uses cookies only after users login, can I ask for cookie consent during account creation instead of website launch? I have a website that uses cookies only if the user logs in. Is it necessary to show a cookie popup banner at website launch or can I ask for consent when user is creating an account (the standard I agree to the website conditions checkbox)?
Under European rules (GDPR, ePrivacy), you only need consent here if you both access or store information on the user's device (such as cookies), and this access/storage is not strictly necessary for a service explicitly requested by the user. A session cookie is strictly necessary for providing a log-in functionality, so such cookies are unlikely to require consent. In contrast, cookies for measuring ad impressions are not strictly necessary for showing the website content. Necessity must always be thought from the user's perspective, not from the provider's economic needs. If you use one cookie for multiple purposes, you should analyze each purpose separately. Maybe setting a cookie does not require consent under one purpose, but accessing the same information for a different purpose could require consent. If you have to ask for consent, this consent must be in line with the GDPR's requirements in Art 7. Consent must be freely given, i.e. there must actually be a way to decline the consent without suffering detriment. Consent must be informed, i.e. the user must be told directly for what consent is being sought, without having to click through to a long privacy policy. Consent must be specific, so it must be possible to consent for one purpose while declining consent for another. An &quot;I agree to the terms of service and privacy policy&quot; checkbox cannot constitute valid GDPR consent because it fails all these criteria: I cannot use the service without agreeing, I'm not told essential information up front (you cannot expect users to actually read long privacy policies), and this is an all-or-nothing bundle that does not allow specific choices. If you do not have to ask for consent, you should still be transparent about your use of cookies, for example by providing a paragraph on this topic in your privacy notice. I think showing a cookie banner would be a bad idea in that scenario, since it could be confused with an invalid consent banner (no way to decline the cookies).
According to 10 rules for getting email unsubscribes right on Econsultancy, the GDPR says of unsubscribing (my emphasis): There is no specific rule about how companies should allow unsubscribing from email, but the General Data Protection Regulation (GDPR) does state that removing consent should be as easy as giving it. This means that if businesses try to make it difficult or confusing they may find themselves receiving complaints. So, assuming they do not otherwise hinder unsubscribing in some of the ways described on that page, would having to pass a Captcha test stop unsubscribing being as easy as signing up? Obviously, it can depend on exactly how you sign up. Some processes may have involved a Captcha test in the first place, or validating your email to activate an account: in such cases, it feels like a clear draw. Even if all that was involved to sign-up was to enter your email-address on a web-page, then passing a single Captcha test doesn't really sound like a significant difference. Also, much as I hate "defending" companies that try to flood you with emails, there are some practical reasons for including something like a Captcha test. In your question you say "when an email was clicked directly from my inbox". However, they don't necessarily know it came directly from your inbox: Depending on the format of the link, it may be possible for a mischievous third-party to spoof requests to the unsubscribe page. A Captcha helps ensure a human actually did the clicking. Even if the format of the link is "encoded" in a way to make it "spoof-proof", it is known that some email clients might "pre-visit" links they find in emails (see, How to stop e-mail clients from visiting links in e-mail automatically? on StackOverflow). One of the reasons for doing this, I believe, is to help protect users from dangerous links in "phishing" and similar emails. However, it can also mean that without some kind of secondary confirmation (e.g. Captcha), people could get unwittingly auto-unsubscribed by their email client. Overall, I would say that a Captcha alone is not sufficient to hinder the unsubscribing process to the point you can hit them with things like GDPR, especially as there are some practical justifications for including one.
Since you are from Europe, GDPR applies to all your processing activities per Art 3(1) GDPR, regardless of where the users are located. If you would like to avoid GDPR compliance, you would have to manage your business from abroad so that you no longer have an European establishment, and would have to avoid offering your services to people who are in Europe. So let's assume that you have no European establishment. Then, GDPR can only apply per Art 3(2) to those processing activities that relate to offering goods or services to people who are in Europe. For determining this, IP-based geolocation is indeed common. Very likely, you do not need consent for this. GDPR does not require consent for everything, just a legal basis. There are six potential legal bases in Art 6(1), though the relevant ones are consent, necessity for performing a contract, legal obligations, and necessity for a legitimate interest. For things like security checks, it would be common to claim a legitimate interest. Complying with GDPR can hurt revenue. However, data subjects have a right to data protection, but you do not have a right to a particular business model. Similarly, paying taxes can &quot;hurt revenue&quot;, but it's not really optional. If your business model can't deal with GDPR compliance (or with taxes), it might not be a sound business model. In Europe, many newspapers have since moved from advertising-only to a consent-or-pay model. That is, the user is given a choice: You can read articles without tracking if you buy a subscription. You can access articles for free if you consent to tracking. The legality of this is hotly debated. In principle, such an approach can be compliant, but the details are problematic, for example that you can only buy subscriptions rather than individual articles, and that these subscriptions are often orders of magnitude more expensive than what would be earned through ads. But this might actually be easier to solve for a mobile application than for a website, due to the availability of in-app payment and micropayment infrastructure. In any case, GDPR limits how much you can &quot;encourage&quot; consent – per Art 7(4), you cannot make access to your service conditional on consent. There must be a way to use your app without consenting to anything, unless that consent is actually necessary for the app to work. For example, consenting to camera access is necessary for a QR code reader app to work. It is extremely unlikely that ads would be necessary in this sense. Users also must not suffer detriment for declining or withdrawing consent. From this, the EDPB has developed the concept of &quot;permissible incentive&quot; in their guidelines on consent. In this post, &quot;Europe&quot; means EU/EEA/UK as appropriate.
Do you have an explicit permission by the artist? Does the artist give a blanket permission to anyone which covers this kind of use of their work (a license)? If no, then you commit a copyright violation when you use their work for your blog. This applies to practically any country which signed the Berne convention which is almost everywhere in the world. Having no commercial interest is usually not an excuse to violate copyright. Regarding which jurisdiction applies when you, your website and the copyright holder are in different countries: I opened a new question about this.
This is a large question, so I'll only put a spotlight on some misconceptions. Why can't Google use legitimate interest instead of consent to serve ads? A data controller such as Google must choose an appropriate legal basis per Art 6(1). But if the legal basis is consent, and the data subject declines or retracts consent, you can't do the processing anyway under legitimate interest instead. It seems that the issue is not that consent was an inappropriate legal basis, but that they decided to use consent and did not collect it properly (see below). However, Google's analysis that they need consent is likely correct. There is an good argument that a website can show first-party ads under a legitimate interest. Google does so as well. But the consent in question is for ad personalization, i.e. on creating detailed profiles on users in order to show more “relevant” ads. For that purpose, Google's legitimate interest would likely not outweigh the data subject's rights and freedoms (compare Art 6(1)(f)). Why might consent be invalid? The GDPR defines consent in Art 4(11) and specifies further requirements in Art 7. The EDPB has issued guidelines 05/2020 and previously WP259 on consent. A core requirement, in addition to the general Art 5(1)(a) transparency principle, is that consent is specific and informed. The user must be informed about the specific purpose for which consent is being asked, and must be able to control consent individually for each purpose. Additionally, consent requires an affirmative action, consent is never the default. The EDPB recommends a layered information approach: in the first information layer, at the point where consent is being asked, the proposed processing activities are summarized. Full details (including all information per Art 13) are provided in a second layer that can be reached via a link. Consent will not be informed if the data subject is required to read the entire privacy policy first. How does the CNIL see Google's approach to consent and transparency? The CNIL asserts that Google failed at every step of a layered information design and failed to obtain valid consent: consent controls were hidden by default, i.e. there was no first information layer consent controls were pre-checked, thus requiring opt-out. That's not how you ask for consent (but might have been alright if Google had used legitimate interest instead). consent is all-or-nothing and not sufficiently granular Google's main information layer is its privacy policy, but it is very general and does not provide sufficiently specific information Google only provides specific information spread across further documents, often 5 or 6 levels deep Could Google rely on Art 6(1)(b) necessity for performance of a contract? If a data subject enters a contract about Google using their data for ads, yes. Otherwise, no. But in practice, necessity for a contract is very similar to consent because the data subject can freely decide whether or not to enter a contract. Even when the legal basis is a contract, the data controller still has an obligation to provide transparent information. Depending on the structure of the contract, a layered approach could be used as well. However, the purposes of processing are ultimately given by the contents of the contract. What about the Ads Data Processing Terms? These terms are not part of the terms of service or the privacy policy that end users agree to. The ads terms are instead part of their B2B offerings.
There is a lot going on in this question, so I'll pick out some individual aspects. Last but not least, I'll discuss if GDPR even applies. Does the GDPR require consent for X? Almost always, no. Consent is only one of many legal bases of processing. A common alternative to consent is a “legitimate interest” where a balancing test is performed between this legitimate interest and your interests, rights, and freedoms. Consent is typically only appropriate if this balancing test fails, for example if you would not reasonably expect this processing activity to occur. It's worth noting that it's a reasonably common occurrence that businesses are sold or merged. This is not unexpected. In general, you would not be required to consent to such a transfer. What can a company do with personal data acquired through a merger/acquisition? The GDPR does not provide explicit provisions for this case. But it might be useful to think about the two cases where (a) the new company is a continuation or successor of the original one, and (b) where the data is transferred (“sold”) to an otherwise unrelated company. In case (a) where the business is continued as normal, there is no change. In case (b) where data is transferred to a separate company, things are more complicated. The original company would need a legal basis for transferring the data. But as mentioned above, there might be a legitimate interest. Arguably, such a transfer could also be based on Art 6(1)(b) if the transfer is necessary to continue to provide the service, for example if the original company would otherwise have to terminate service. Of course, activities like data brokering where access to data is granted to unrelated third parties would generally fail to be covered by contractual necessity or a legitimate interest, and would probably need consent – but that doesn't seem to be the case here. When a data controller (such as the new company) acquires your personal data from sources other than directly from you, then they are subject to the notice requirements in Art 14. They have to actively notify you about their processing activities. But because you received emails that mentioned the transfer, this condition might have been met. Of course the new company continues to be bound by the purpose limitation principle as detailed in Art 6(4) – they can only use the data for purposes that are compatible with the purposes for which the data was initially collected. Thus, the new company cannot arbitrarily widen processing purposes, though some change in scope is certainly permissible. How does the GDPR right to object and to restrict processing apply here? The Art 21 GDPR right to object means that if the legal basis for a processing activity is a “legitimate interest”, then you can ask for an opt-out. But in some cases, this objection does not have to be granted. An objection essentially requires the controller to repeat the legitimate interest balancing test, taking into account the “grounds relating to [your] particular situation” that you provided in the objection. The Art 18 GDPR right to restrict processing is an alternative to the right to erasure. It applies only in narrow circumstances, for example while an objection is being checked. It is likely that you were informed about the transfer to a new company about 1 month in advance, so that you would have been able to prevent this transfer by closing your account prior to the deadline. If the new company conducts processing activities based on a legitimate interest, then their presumably GDPR-compliant privacy notice about which you were notified will certainly explain that you have a right to object. Is the new company GDPR-compliant? That is impossible to tell, but nothing you've shown so far indicates that they're non-compliant. My largest issue with this story is that the new company is from Australia, a country with extraordinarily bad privacy protections (as of 2022). However, due to the way how the GDPR treats international transfers of data, this doesn't prevent Australian data controllers from being GDPR-compliant, although it does make it difficult for other companies to use services based in Australia. Does GDPR even apply? Whether GDPR applies to a non-European company depends only on whether they either offer goods or services to people who are in Europe (“targeting criterion”), and whether the monitor people's behavior that takes place in Europe. Factors such as your citizenship would be irrelevant. I'll ignore the monitoring criterion, and focus on the targeting criterion. I'll assume that you are in Europe (EU/EEA or UK). Whether a company is targeting people in Europe depends primarily on the company's intentions. It does not matter whether the service is accessible from Europe. Thus, it is quite possible that the original company was not subject to the GDPR. Then, any questions about GDPR, consent, and data transfers are moot. In contrast, the new company clearly mentions GDPR-compliance, which would only matter if they intend for people in Europe to use their services. So GDPR probably applies to them, giving you the full suite of GDPR data subject rights as (hopefully) outlined in their privacy notice. And as long as they notified you that they acquired your personal data in accordance of Art 14, I don't seen anything that they might have done wrong in respect to this acquisition/merger.
Is it GDPR compliant that I can't access the account that I created and the personal data that I shared because "I haven't completed their internal pre-qualification process"? Article 15 defines a “Right of access to the data subject” but it's difficult to see how this could be construed as a right to log into a specific website. Common sense suggests this would be a very bad idea. If they are willing to provide the data through another means (say a report or data dump of some sort), the obligation would seem to be met. In fact, article 15(3) even states that data controllers should merely provide the information in a “commonly used electronic form” (i.e. not necessarily through access to their systems or whatever form they are using internally for the processing). Have you asked for that and would you be satisfied by that resolution? Is it GDPR compliant that their answer to my deletion request is "We will delete the data..." The text of article 17 (right to erasure) explicitly specifies that such a request must be honored without “undue delay”. Article 12, which defines some of the modalities for the rights to access, rectification or erasure by the data subject, also provides that controllers shall “provide information on action taken on a request […] without undue delay and in any event within one month of receipt of the request”. You haven't provided any time frame and I don't think there is anything wrong with acknowledging the request by promising they “will” do it but in light of article 12, it seems you would indeed be entitled to know once they have actually taken further action. However, you implied you might want to access the data first and it's not clear to me whether you explicitly invoked the GDPR in earlier communications. So I would clarify and reiterate my request (access or erasure) and ask them for explicit confirmation once it has been satisfied.
There is nothing in the GDPR requiring you to collect individual personally identifiable information. If the website has no need, and the website owner no desire, to collect such information, there is no requirement to do so. The GDPR requires that if such information is collected, that there is a lawful basis, and that it be handled appropriately and stored securely, and deleted when there is no longer a need to retain it, or on a proper request. If no such information is collected in the first place, all the rules about how to handle it do not apply. It is possible that some law of an individual country in the EU might mandate collection of some particular information, but I have not heard of any such requirement.