View source for Privacy/DNT-related Legal Environment

This page collects relevant information about Do Not Track in different legal jurisdictions, as organized by the Tracking Protection Working Group and the Privacy Interest Group.

''See also: [http://www.w3.org/2011/tracking-protection/international.html activities of the Global Considerations Task Force of the Tracking Protection Working Group]''

== US Federal Law ==

== US State Law ==

== EU Law ==
=== GDPR ===

The General Data Protection Regulation (GDPR) was initially drafted in 2012 by the European Commission to replace the Data Protection Directive enacted in 1995 (Directive 95/46/EC). Since then the GDPR has been intensively debated and amended by both the European Parliament of directly elected representatives and the European Council (which represents the executive Governments of Member States). The three bodies informally agreed a [http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN consolidated version of the text] on December 15th 2015 which was overwhelmingly backed 2 days later by the Parliament's LIBE Committee (Civil Liberties, Justice and Home Affairs). It was approved by the full European Parliament and the Council of the European Union in April 2016, and was formally published in the Official Journal of the European Union on May 4, 2016 as [http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN Regulation 2016/69], effective May 28, 2018. 

Like the preceding Directive the Regulation covers the processing of personal data within the European Union and is an important component of EU privacy and human rights law.

Personal data is defined in the Regulation as <blockquote>any information relating to an identified or identifiable natural person 'data subject'; an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person; </blockquote>

This is clearly meant to include data associated with a persistent online identifier such as a UID cookie, further elaborated in Recital 30:
<blockquote>Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them. <i>Recital 30</i></blockquote>

As in the Data Protection Directive, personal data can only be processed, i.e. collected or used, if there is a legal basis for doing so.
The only legal bases as described in Article 6(1) are:
<ol style="list-style-type: lower-alpha;">
  <li>The Data Subject (person) has given their unambiguous consent.
      <p><blockquote>Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided. <i>Recital 32</i> </blockquote>
</p>
</li>
  <li>Processing (of personal data) is necessary for the performance of a contract (of which the person is party)</li>
  <li>It is necessary for compliance with a legal obligation of the Data Controller (e.g. a company using the data)</li>
  <li>It is necessary to protect vital interests (life & limb).</li>
  <li>It is necessary to perform a task in the public interest.</li>
  <li>The Data Controller claims a “legitimate interest”, but “except where such interests are overridden by the interests or fundamental rights and freedoms” of the person.
   <p>In some circumstances Direct Marketing may be claimed as a "legitimate interest" of a Data Controller: <blockquote>The legitimate interests of a controller, including those of a controller to which the personal data may be disclosed, or of a third party, may provide a legal basis for processing, provided that the interests or the fundamental rights and freedoms of the data subject are not overriding, taking into consideration the reasonable expectations of data subjects based on their relationship with the controller. Such legitimate interest could exist for example where there is a relevant and appropriate relationship between the data subject and the controller in situations such as where the data subject is a client or in the service of the controller. At any rate the existence of a legitimate interest would need careful assessment including whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place. The interests and fundamental rights of the data subject could in particular override the interest of the data controller where personal data are processed in circumstances where data subjects do not reasonably expect further processing. Given that it is for the legislator to provide by law for the legal basis for public authorities to process personal data, that legal basis should not apply to the processing by public authorities in the performance of their tasks. The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned. The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.<i>Recital 47</i></blockquote>
</p>
   </li>
</ol>

In all cases data needs to be processed transparently and fairly:
<blockquote>Any processing of personal data should be lawful and fair. It should be transparent to natural persons that personal data concerning them are collected, used, consulted or otherwise processed and to what extent the personal data are or will be processed. The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used. That principle concerns, in particular, information to the data subjects on the identity of the controller and the purposes of the processing and further information to ensure fair and transparent processing in respect of the natural persons concerned and their right to obtain confirmation and communication of personal data concerning them which are being processed. Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing. In particular, the specific purposes for which personal data are processed should be explicit and legitimate and determined at the time of the collection of the personal data. The personal data should be adequate, relevant and limited to what is necessary for the purposes for which they are processed. This requires, in particular, ensuring that the period for which the personal data are stored is limited to a strict minimum. Personal data should be processed only if the purpose of the processing could not reasonably be fulfilled by other means. In order to ensure that the personal data are not kept longer than necessary, time limits should be established by the controller for erasure or for a periodic review. Every reasonable step should be taken to ensure that personal data which are inaccurate are rectified or deleted. Personal data should be processed in a manner that ensures appropriate security and confidentiality of the personal data, including for preventing unauthorised access to or use of personal data and the equipment used for the processing.  <i>Recital 39</i></blockquote>

In certain circumstances, for example if the purpose of data collection has been sufficiently and clearly explained, the Do Not Track DNT:0 "User Granted Exception" could indicate that a user has given their consent. 

Article 25.2 requires that default settings should be such to ensure data protection, which could be read as requiring that the default setting for DNT should be 1.
<blockquote>
The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible without the individual's intervention to an indefinite number of natural persons
<i>Article 25.2</i>
</blockquote>

Also the Do Not Track general preference DNT: 1 could meet the requirements of A21 regarding the Data Subject's "Right to Object" to processing where a Data Controller claims a "legitimate interest" or "public interest" basis. A21.5 specifies that that could be indicated by "automated means".
<blockquote>
<p>1. The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to the processing of personal data concerning him or her which is based on points (e) [the "public interest" basis] or (f) ["legitimate interest"] of Article 6(1), including profiling based on these provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.  
</p>
<p>2. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to the processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.
</p>   
<p>3. Where the data subject objects to the processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
</p>  
<p>4. At the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information.
</p>  
<p>5. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications. </p>
<p>6. Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), the data subject, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest. 
</p>
<i>Article 21</i>
</blockquote>
<p>When consent is revoked, Article 17 requires that any personal data collected is erased</p>
<blockquote>
<p>
Right to erasure ('right to be forgotten')
1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
(a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
(b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:
(c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);
(d) the personal data have been unlawfully processed;
(e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
(f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).
2. Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:
(a) for exercising the right of freedom of expression and information;
(b) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(c) for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3);
(d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
(e) for the establishment, exercise or defence of legal claims.
</p>
<i>Article 17</i>
</blockquote>
''Please add to these sections or create new sections as appropriate. None of this information constitutes legal advice; this is intended just as a useful collection of resources.''