One of the great things about GDPR is that this sort of thing will be flatly illegal. Want to use my IP address to look up information about me? Great, so long as you ask for, and get, my explicit consent.
If you're selling corporate targeted tools, you can assume that visitors represent a company and the lookup is a corporation. Facts about a company are not personal data per the GDPR. Note that a work email is certainly personal data, but the fact that a visitor works at corporation X isn't. As always, consult with your counsel. But that's what ours says.
And since you don't know what you're talking about, ok as per previous discussions with ICO.
https://i.imgur.com/QPzXiWN.png
https://i.imgur.com/KiX2aCc.png
Although time will tell. My gut tells me that users will click decline and without any negative consequences (a redirect) and the dialog simply closes. Users will get used to doing that for all other EU sites and these startups marketing efforts will suffer.
Remember cookie law? Everyone I know is conditioned to click and not even look at the privacy policy.
That means overall, less profits for marketing and then lost sales.
It's going to be very interesting to see how competitive EU startups become verses US startups where in the US, GDPR doesn't exist (for now).
That said as well. Where US startups have much greater profits for marketing to non-EU regions, and EU startups cannot compete again due to less revenue due to regulations. EU startups will shrink against their US counterparts.
Again, all of this is my own speculation and lets see how things are in 2 years time.
Very interesting times ahead.
Something tells me they collect more than "e.g. your name and email address."
It asks for permission for 3 things, and while the first 2 could arguably be necessary for the "service", the third one (updates and promotions) clearly isn't. And it seems they refuse to provide service if you don't agree with everything in bulk.
This would be akin to an airline declining to sell you a plane ticket if you don't enroll in their promotional newsletter. Flat out illegal under the GDPR.
"(14) The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence, in relation to the processing of their personal data. This Regulation does not cover the processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person."
[0] http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:O...
I live alone - my ip address is (and has been for a decade or more) static. It without doubt will qualify as Personally Identifying Information.