Can Disney+ require me to disclose my age and gender in order to continue streaming? I just received this email a few moments ago: Disney+ Provide your birthdate and gender to keep streaming Disney+ now requires additional information from the primary account holder, including your birthdate and what best describes your gender. To avoid any interruption to your streaming, please update your account with this information before December 8, 2022. Screenshot: And they say: Disney+ is also requiring what best describes your gender. This information will be used to personalize your experience, which may include ads, and in other ways consistent with our Privacy Policy As per my understanding of the CRPA, the section on Data Minimization (as reported by this website) says: Businesses must only collect and retain what’s “reasonably necessary” and “proportionate” to the intended purpose. I already have an account in good-standing with Disney+ for about a year now - I'm sure they already know I'm a legal adult for the reasonable purpose of controlling age-restricted content within their streaming service - and to require a statement of gender disclosure is just odd - so I cannot fathom how they can hold my access to their service for ransom at the price of my personal information.
Disney's help page on this says I don’t want to provide my birthdate or gender. What can I do? Providing a birthdate is required for all Disney+ accounts/profiles while a gender is required for all accounts/profiles over the age of 13. Note that for gender submission, you may elect “Prefer not to say.” If you do not wish to provide your birthdate or gender, you may cancel your account by visiting your Account page or by contacting Disney+ Support. It's reasonable to provide proof of age: COPPA in the US requires it to protect those under 13. And you don't have to give them your gender.
It is absolutely not the case that Providers are not allowed to keep PII without consent. Article 6 of the GDPR identifies six possible lawful bases for processing personal information. These are: (a) the data subject has given consent ... (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) processing is necessary for compliance with a legal obligation to which the controller is subject; (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks. If a person requests services from an online service provider, basis (b) will apply, at least to some information. If there is evidence of criminal activity, basis (c) may well apply, as it also will for much routine record keeping. Any in many such cases, basis (e) or (f) will also apply. In short, article 6 does not create a &quot;haven for online criminals/hackers&quot;. In a comment on another answer the OP writes: The offender has the right to not be identifiable and he can't be denied this right That is simply not correct. Nothing in the GDPR says anything of the sort. It is true that consent may not be forced, but if a user requests a service that service may require the user to identify him- or herself. For example, one cannot order physical goods without giving a name and a shipping address. And the provider may retain PI and even PII when it has a &quot;legitimate interest&quot; in doing so, although if challenged it must justify that legitimate interest.
I’ve managed to answer my own question. Age discrimination legislation only applies to over 18s: It’s only discrimination if a trader or service provider treats you unfairly because of: age - if you’re 18 or over disability gender reassignment pregnancy and maternity race religion or belief sex sexual orientation Source
Whether consent is necessary depends on the specific processing purposes. For example, general usage statistics about search terms or about the usage of the site likely fall under a legitimate interest. Outside of the GDPR, there can be consent requirements for the use of specific technologies. Per the ePrivacy directive, consent is required for accessing or setting cookies on a user device, unless the cookie is strictly necessary for the service requested by the user (“functional cookie”). This consent requirement also extends to other storage and fingerprinting technologies. A functional cookie could e.g. be used to store a history of search terms on the user device itself. However, ad personalization is not strictly necessary for the search functionality, so setting cookies (or using similar technologies) for ad personalization requires consent, regardless of whether ad personalization itself would require consent. To determine whether a processing purpose falls under a legitimate interest, the data controller must weight the interest against the data subject's rights and freedoms. There are no objective guidelines on this, and ultimately a court would have to decide. However, I would assume that the tracking necessary for ad personalization is an inappropriate infringement on the data subject's rights and freedoms, so that ad personalization cannot fall under a legitimate interest. The data controller would have to choose a different legal basis, which effectively only leaves consent.
Your VPN scenario is why you have to show the banner to everyone. If you somehow knew beyond any doubt that someone was not in the EU, then you would not have to show a banner, but because you can't verify that, you should always show the banner. Doing so also protects against accidentally violating a similar law in another country; the GDPR is the best-known privacy law, but it is far from the only one. It's good practice to ask for people's permission before collecting their information anyway.
Yes If you are in the EU, or your players are in the EU and your service is targeted at some part of (or all of) the EU, then this pretty clearly falls within the scope of the GDPR. Such a service would be collecting data associated with natural persons. At least some of it would be made public along with an online identifier, and other parts would be processed and stored, even if disclosed only in anonymized form. (By the way it is a non-trivial task to anonymize data well enough that it is no longer persona data under the GDPR. But let's suppose yoru methods are good enough.) Under GDPR Article 6 the DC must have a lawful basis for such processing. If the basis is &quot;consent&quot; then the consent must be freely given, whch means giving consent may not be a condition of using the service. Under GDPR Article 13 a notice must be sent to the Data Subject (DS) when the data is collected from the subject, including some 11 items or categories of information about the collection process, the Data Controller (DC), the purposes of processing, the legal basis of processing (which the DC must define), who will receive the data, the data retention period, and various rights of the DS. Such a service must be prepared to respond to data access and data erasure requests, under articles 15-17, and data restriction requests under article 18. It must provide a method for a DS to easily make such requests. Other GDPR provisions may well apply in addition to these, but that is enough to show that such service is very likely to be within the scope of the GDPR, unless none of the DSs are present in the EU or the related market area.
A web site that is serious on protecting some content behind a paywall will put the protected content, or a version of the page with both protected and unprotected content, on separate page or pages, so arranged that a user will not be able to follow the link until that user has signed in and been accepted as an authorized user. A site that merely uses CSS to hide "protected" content is not really protecting it. CSS is designed to be modified by the ultimate user -- that is part of its function. If the site chooses to send you content, you are entitled to read it. Even if some of the content has a CSS tag attached which suppresses or obscures the display of that content, they know perfectly well that any user can supersede this with local CSS, and so I don't see how they have any legal claim, nor any way of knowing if you have accessed the "hidden" content or not. If you attempt to bypass or hack a login screen, that might be circumvention under the US DMCA, or "Unauthorized computer access" under any of several laws.
The other answers don't quite spell it out, so I will. There is no law in the UK requiring landlords or their agents to show a property to all parties interested - refusal to show a property may however in some cases fall under discrimination laws, so that might be something you can pursue if you feel the refusal is due to your gender, race or sexual orientation. While they may have to justify their data collection under the GDPR, that is entirely separate to their refusal to show the property to you.