The pop-up is not part of the law. The law says user should be aware and able to do informed changes, not that they should be annoyed. That part is entirely on companies
If there is a pop up there, for just accessing the home page of the European Union, is that site collecting too much data?
There's even a bit at the bottom of https://gdpr.eu
> We use cookies to ensure that we give you the best experience on our website. If you continue to use this site we will assume that you are happy with it.
https://gdpr.eu/eu-gdpr-personal-data/
Looking back at the GDPR’s definition, we have a list of different types of identifiers: “a name, an identification number, location data, an online identifier.” A special mention should be made for biometric data as well, such as fingerprints, which can also work as identifiers. While most of these are straightforward, online identifiers are a bit trickier. Fortunately, the GDPR provides several examples in Recital 30 that include:
Internet protocol (IP) addresses;
cookie identifiers; and
other identifiers such as radio frequency identification (RFID) tags.
These identifiers refer to information that is related to an individual’s tools, applications, or devices, like their computer or smartphone. The above is by no means an exhaustive list. Any information that could identify a specific device, like its digital fingerprint, are identifiers.A very common example is recording the IP address for technical (debugging, ensuring site functionality) and legal (security, audit logs) does fall under Legitimate Interest.
Worst case you have to mention it in privacy policy.
The thing you can't do is let your marketing team or others grab at it in any way, or sell it to other vendors, and arguably you should not move outside of safe countries.
It’s not an EU site.
GDPR.EU is a website operated by Proton Technologies AG, which is co-funded by Project REP-791727-1 of the Horizon 2020 Framework Programme of the European Union. This is not an official EU Commission or Government resource. The europa.eu webpage concerning GDPR can be found here. Nothing found in this portal constitutes legal advice.
Would you be surprised if there was a big banner at the bottom of the page that read
This site uses cookies. Visit our cookies policy page or click the link in any footer for more information and to change your preferencesOn a technical level this would likely mean turning off access logs and other tracking mechanisms. (IP addresses are considered personal data last I checked.)
Also I put a bit of responsibility on us, the consumers. It does not seem to me that popups are such a real issue since no website reported: we are removing popups because users are so annoyed that they stopped visiting our website.
Then tell us how companies should implement this law both
- without annoying the user
- not being in a risk of getting sued
If the law does not make this relatively easy, one has a right to be furious about the EU.
The main problem, and the reason certain parties are working so hard not to comply, is that GDPR makes several business models illegal. (Not that I see that as much of a problem.)
This is what the law says, but not how shysters/pettifoggers interpret it. :-(
That isn't how the law works for things like this though; what is plain to a lawyer is different to an untrained person. People make that mistake with tax law all the time; they read something and come up with a plain interpretation that shows they don't have to pay their taxes and that delusion persists until someone explains the actual, less plain, reading.
It isn't the worst starting point but winging the law with untrained readings is not really acceptable for running a business.
But you don't (typically) get into trouble with the law enforcement agencies if you don't/didn't understand the laws of physics correctly.
Just keep them out of hands of parties that might want to use them for other reasons.
Shysters/pettifoggers are very "flexible" (in a negative way) in the interpretation what is "necessary for your site to work". :-(