Can you legally use eye tracking on your website? If user visits your website, can you legally use their camera to track where they are looking at and then transform this data to heatmaps? If yes, under what circumstances? Our company created a web application, we are in Europe but later we would like to give access to this app to people from all around the world (and track where they are looking at).
Yes, you can use such eye tracking if you obtain consent in a suitable manner. But obtaining consent is going to be very difficult for you. The processing activity in question occurs within the context of an EU establishment of the data controller. Thus, GDPR applies regardless of where the data subjects are located. Under GDPR, any processing activity needs a clear purpose and a legal basis. Typical legal bases are necessity for performing a contract with the data subject, legal obligations, a legitimate interest, or consent. Conditions for consent are listed in Art 7 GDPR. Once your have a purpose that is covered by a legal basis, you can collect the minimum data necessary to achieve the purpose. For example, let's assume that the purpose is a scientific study for which gaze tracking is necessary. The study's subjects can be informed about the context of the study, about how the data will be used, and can then be asked for consent for proceeding. Of course, participation in the study is only possible when consent is given. This is perfectly fine as far as the GDPR is concerned. But things might be more difficult when data is used for a different purpose, for example in order to track user interests in a web shop. You do have a legitimate interest in optimizing the website, but this interest likely doesn't outweigh the user's privacy interests. Legitimate interest always requires a careful balancing test. If the user cannot reasonably expect the data collection to happen, that is an indication that consent would be a better legal basis than legitimate interest. Accessing a camera feed means accessing information stored on the end user's device. Per the ePrivacy directive, this requires consent regardless of whether the information in question is personal data. Cookies, mouse pointer tracking, or eye tracking with a camera are all equivalent in this regard. Consent must be specific, informed, and freely given. It is an unambiguous indication of the data subject's wishes, and must involve some clear statement or affirmative action. Prior to starting the eye tracking, you must provide sufficient information about what is happening, and must make it possible to easily decline consent. You cannot bundle unrelated consent together (e.g. eye tracking consent + cookie consent). You cannot make access to a service conditional on unrelated consent. E.g. a web shop does not need camera access, but an augmented reality does. Still, consent must be specific so consent for AR purposes can probably not be used to authorize eye tracking, which might need separate consent. Browsers do not grant camera access by default, and instead show a permission dialogue where the user can allow access or block further requests. This permission dialogue cannot replace your compliance obligations such as providing the necessary information so that the user can make an informed choice. Since GDPR requires that consent is freely given and can be declined, you might find it difficult to convince anyone to give consent to this fairly invasive tracking procedure. You might be able to incentivize consent e.g. with small discounts on a web shop, but the incentive must remain small enough that there really is a free choice between giving or declining consent. The EDPB has issued guidelines that are relevant to your scenario. These guidelines are not law, but are well-reasoned official interpretations that are frequently cited by courts. Guidelines 05/2020 on consent Guidelines 3/2019 on processing of personal data through video devices Practically speaking, I doubt you will find eye tracking to be useful. First, you can likely achieve your purposes through less invasive means. Recall that the GDPR only allows you to process the minimum data necessary to achieve a purpose. Second, eye tracking is difficult for technical reasons. Bad lighting and weird angles make it difficult to obtain a useful feed. Cameras might be in different positions relative to the browser window, so that the eye tracking would have to be calibrated before acquiring data. Eye tracking typically involves processing the video feed on the user's device, but this is computationally expensive that will make the website unusable on lower-end devices, in particular mobile devices. And of course, many PCs don't have a camera in the first place.
IANAL. (1) GDPR is certainly relevant. (2) This is certainly "personal data" under the definition in GDPR article 4. (3) Maintaining this data is probably lawful under article 6 sections 1(a) (consent) - provided that the Terms and Conditions of the site make clear that the user by signing up is consenting to this information being held (3) There is certainly an obligation under article 14 to disclose that the information exists, and to say how it used. (4) Article 15 says that data subjects are entitled to see the information and know what recipients or categories of recipient have access to the information (I don't know whether it's enough to just say "moderators", or whether the moderators need to be identified). (5) I can't see any reasons why the obligations under articles 16, 17, and 18 regarding rectification, erasure, and restriction of processing aren't relevant. This is exactly the kind of situation that GDPR is designed to address. If you're restricting the service available to particular users based on a record of their behaviour or on judgements made by moderators, then they absolutely have a right to know, and a right of redress.
I live in MD near DC, and have been ticketed by the cameras in both DC and MD. At least for speeding and red-light violations (and I think for all camera detected violations) these are just fines, not true moving violations in that no license points are assessed, and there is no impact on insurance, provided the ticket is paid, unlike what would have happened had an officer written the ticket in person. One can contest the ticket, but it is not likely to be worth the time and trouble. This policy of not assessing points is precisely because there is no assured way of determining who the driver is with current technology, although cameras that can see the driver through the windshield and match him or her against a database by facial recognition may be coming. Currently a human reviews the images in an effort to rule out false positives and certify that an actual violation is shown. The name and title of this person is shown on the notice I get, at least from MD. What one can do "proactively": do not speed or go through red lights pay all camera tickets promptly (or file the paperwork to contest them). If unpaid beyond the deadline they turn into more serious violations that do carry points, just like failing to attend a court date.
You are processing the users IP address in order to carry out the translation to a physical location (see my comment for the technical issues with that) and an IP address is most certainly considered personal information, so yes under the GDPR you are going to need a published policy because you are both data controller and data processor. You need to inform the user of what you are doing, and you need to tell them of the legal basis for the processing (there are several under the GDPR, of which consent is only one - but in your case its going to be the easiest to justify). If you use a third party service for the location translation, you also need to inform the user of that and make available the third party services data processing policy.
Assuming the USA, since that's where they appear to be located. Spreading misinformation is not illegal- it is protected by the first amendment. There are exceptions but I can't see how any would apply here. You haven't mentioned any that you think apply. If some of the videos on the site guaranteed results or made medical claims, maybe that could be considered false advertising. However, I see no evidence of this. Users are advertised that paying for access to a bunch of hocum videos will get them access to a bunch of snake oil and this appears to be the case.
Both the displayed site (including all text and images) and the html, css, javascript and other code that generates the display are protected by copyright. This is true in pretty much every country. You would not be able to reuse them lawfully without permission, unless an exception to copyright applies. If no exception applies, and you have not obtained permission, this is copyright infringement. In most cases copyright infringement is treated as a tort (a civil matter), not as a crime. This means that law enforcement generally will take no action and have no interest in such a situation. The copyright owner could sue for infringement, and possibly collect money damages. In the US, statutory damages can be as high as $30,000, or up to $150,000 for &quot;wilful&quot; infringement, or as low as $750 (per work infringed). Or actual damages can be collected instead. In other countries, actual damages plus costs of suit are more likely, but the rule can be different in each country. The possible exceptions to copyright vary significantly in different countries. In the US the major exception is Fair use. See Is this copyright infringement? Is it fair use? What if I don&#39;t make any money off it? and I have a question about copyright. What should I read before I ask it? for more information In general short snippets of code can probably be used under fair use, but substantial parts of the code or the displayed site are less likely to qualify as fair use. And if it is illegal then why are there so many legal open source or paid software and applications for cloning of website like httrack, cyotek, webcopy etc? Most of these tools have legitimate uses, including learning how a site is constructed without distributing copied content; and cloning or partial cloning of a site with permission. Even if the tools were mostly used for unlawful copying, that might well not be a high priority for law enforcement, and cross-border law enforcement (which this in many cases would involve) is often much harder for the police and other authorities.
I think haveibeenpwned would be legal in the EU because it carries out a task in the public interest (Art. 6(1)(e)), and it shares no more data then necessary, for example you can search for a password, but it would not show you the emailaddress which belongs to that password. It would also be legal for you to hold a copy of a leaked database, but only if you have a legitimate interest (Art. 6(1)(f)) to have it. Being a security company does not change that, but finding a legitimate interest might be easier. If you have a legitimate interest to hold a copy of a leaked database, it does not mean you can use it in any way you like. For example testing if the password still works, is very likely illegal everywhere in the EU. But I'm not familiar with the UK laws.
It is hard to prove a negative, but no - there is not rule that an app cannot track a user while the app is in the background. Almost every GPS-function app on every smart phone does the very thing you are talking about.