Dozens of websites shut down their activities completely, others forced users to agree to new terms of service, and inboxes have been flooded with emails begging customers to remain on mailing lists as the GDPR rules come into force on Friday.
The biggest update in data protection laws since the 1990s is posing major challenges for developers and businesses – while giving substantial new powers to consumers.
Margot James, the digital minister, told the Guardian: “Of the eight guiding principles that governed the use of personal information under the old act, we have made an important addition – accountability. In the wake of the Cambridge Analytica scandal, UK citizens more than ever need reassurances their data is as safe as it can be and that organisations are accountable for it.”
She said businesses would now have to prove they had been given permission to use a individual’s information, including contact details.
“Except in certain, limited instances, organisations now must demonstrate they have our explicit consent to process our sensitive personal data. Generally, we’ve also given greater control to the British public over how their data is used. No doubt like me you’ll have received a flurry of emails in recent weeks from the organisations currently holding your data, and perhaps some you weren’t even aware did, asking for you to re-submit this consent.”
The cascade of emails from businesses has become the most visible consumer-facing effect of the new regulation, sent by firms who want users to actively give their consent to remain on a mailing list. But, according to the Information Commissioner’s Office, such emails aren’t necessary to comply with the law.
“Some of the myths we’ve heard are, ‘GDPR means I won’t be able to send my newsletter out anymore’ or ‘GDPR says I’ll need to get fresh consent for everything I do’,” Steve Wood, the deputy information commissioner, wrote on the organisation’s website earlier this month. “I can say categorically that these are wrong … You do not need to automatically refresh all existing consents in preparation for the new law.”
Campaign groups and political parties who have come to rely on large email mailing lists to contact supporters could find they lose one of their main ways of communicating with the public. It has been suggested that businesses could be forced turn to more traditional methods – such as targeting customers with direct mail through the postal system – to reach customers.
How has becoming compliant played out in your workplace? What short and long term effects will the process have on the business?
You can share your experiences by filling in this encrypted form – anonymously if you wish. Your responses will only be seen by the Guardian and we’ll feature some of your responses in our reporting. You can read terms of service here.
As the GDPR deadline neared, some websites and services started to push users to agree to onerous new terms of service before they could continue on to their destination.
Websites run by Oath, the media firm formed through the merger of Yahoo! and AOL, received a blanket request on Thursday morning, asking users for consent “to use your … data to understand your interests and personalise and measure ads”. Users could click OK to move on, or follow a chain of further links to discover that the consent granted involved sharing data with more than a hundred ad networks.
Another Oath site, Tumblr, placed a similar clickthrough before users. The blogging platform did offer some links to understand “how our partners use this data”. However, even this background information was hosted on Tumblr blogs, meaning users had to accept the terms in order to read information about the terms they were accepting.
The US media network NPR took a simpler approach. Users could either agree to the new terms, or decline and be taken to a plain-text version of the site, looking for all the world like it had last been updated in 1996.
It wasn’t just websites. PC hardware maker Razer issued an update to one of its computer mice, warning that users may find their devices weren’t working if they didn’t update; Chinese smart-home manufacturer Yeelight disabled inter-connected lightbulbs because of the data protection regulation.
And a growing number of companies are taking the nuclear option to ensure compliance: blocking all European users from their servers.
Instapaper, a service owned by the US firm Pinterest which enables users to save articles to read at a later date, became the latest to disconnect European customers on Thursday. It said the cutoff was temporary while it made the required changes, and told users: “We apologise for any inconvenience, and we intend to restore access as soon as possible.” Pinterest did not respond to a request for comment.
Other companies have taken a more permanent approach. Unroll.me, an inbox management firm, announced it was completely withdrawing services for EU companies due to an inability to offer its product – which is monetised by selling insights gleaned from reading users’ emails – in a way that was compatible with EU law. “We are truly sorry that we are unable to offer our service to you,” the company told EU users.
American media network A+E has blocked EU visitors from all its websites, including History.com, and some multiplayer online games, including Ragnarok Online, have switched off their EU servers.
Other firms have not gone so far as to blame the new regulation but have closed EU operations with convenient timing. Crowdpac, a political fundraising organisation set up by David Cameron’s former advisor Steve Hilton, announced it was closing its UK wing “for business reasons” until further notice. The company, which was still raising funds in the UK as recently as Sunday, now says it “hopes one day to be back”.
Klout, a social media analytics service, and Super Monday Night Combat, an online game, will shut down on Friday. Lithium, the owner of Klout, said: “Klout no longer made sense as a standalone service. The upcoming deadline for GDPR implementation simply expedited our plans to sunset Klout.”
Brian Honan, a data protection expert, said he viewed the shutdowns as a reasonable consequence of the new law. “The GDPR’s primary goal is to enhance the protections around the gathering and processing of the personal data belonging to individuals residing within the European Union,” he said.
“Companies have had well over two years to prepare for the enforcement date and to be ready.”
Unfortunately, even going to the extremes of blocking every user based in the EU might not be enough to inure companies from the consequences of GDPR: the law applies to data processed on EU citizens wherever they are based in the world.
