It's actually nothing to worry about. You as users end up with more protection, and companies like us are left in a place where we've got a framework for handling your information that puts much stronger guard rails around responsibility, transparency, and accountability.
The GDPR (General Data Protection Regulation) is a good thing, and not just for European citizens. While you've probably heard quite a few folks grumbling about it, including some of our own, we feel that it's a major step in the right direction and we're enthusiastically embracing it.
tl;dr;
— There's going to be a new 'legal portal' launching on or just before the last week of May, 2018. You'll see a banner you can dismiss when it launches; we strongly recommend that you check it out. You'll also receive an email to let you know about the changes. We're expanding our privacy policy, providing a policy on cookies, and giving you ways that you can view and interact with data that we store about you. While this was done to be compliant with the GDPR, we strongly believe in the intent and spirit of the GDPR, and have extended its protection to everyone.
It's never a bad idea to get your legal documents in order so that folks can find them easily, and make use of any associated tools, but the landing of the GDPR is an especially fine reason to do that. So, we're rolling out what we call our 'legal hub', which will replace /legal
on the sites; it's going to look a lot like this1:
1Note: The actual interface will likely vary from what's depicted; it's still a work-in-progress. Things like e-opt-out for the arbitration clause are likely to appear here, anchored links might appear or work differently, etc.
That's a bit different from what we currently have. Our goals in this update are to ensure we're fully GDPR-compliant, that the rights and protections afforded by the GDPR are extended to all of our users, regardless of location, and that all of the information anyone would want to know about our policies is as easy to find.
We've been rather proud of our plain English privacy policy that we created during a time when a common complaint was companies making such policies as difficult to understand as possible, which is a key reason that we were so eager to embrace the intent and protections of the GDPR. That sets our final goal, to make all policies as easy to read and understand as is legally possible, with as much transparency as possible.
The GDPR puts some pretty powerful new tools 2 in the hands of users to control their information:
2Depicted implementation is subject to change, the legal hub and tools it offers are still being finalized.
.. and that's a great reason for every company to firmly get behind it. As we've said, changes are pretty reaching. We'll touch on some stuff, and then just open things to questions.
New cookie policy summary:
The cookie policy lets folks know about the types of cookies that we utilize, and why. It's broken down by product, or everything from Q&A to display ads, analytics and third-party cookies.
This policy is important because not only does it explain what cookies we set and why we need them, the process of explaining it and requirements to keep it updated help keep us mindful of how we use them as our distributed development teams continue to grow.
It's also neat if you just like poking around at how things work. Great things get built as a result of simply indulging curiosity.
Many product-specific updates:
There are a number of places where we need to mention Stack Overflow For Teams as a product (and one where we collect information about you). There's also stuff about Talent (formerly Careers), advertising products, and other things. There are many places where policies don't really change beyond what's needed for GDPR compliance, we're just adding more things that these policies cover.
Summary of ToS updates:
The first two items in our previous Terms Of Service update announcement are pretty unremarkable. To reiterate, we'll be specifically addressing some needs for Stack Overflow For Teams, and ensuring everything is compatible with the GDPR.
The final update regarding the arbitration clause will be amended to include two means of electronic opt-out (through email, as well as through a form on the site); snail mail will continue to work. All means of opting out will generate an indication that you’ve opted out, which could come in the form of an email reply, or a visual indication on a form that you’ve previously triggered it, provided that you have an account. If we can't correlate your request to opt-out to an actual profile, we'll just keep the request as notice that you've opted-out on file.
The arbitration clause in the new terms will not go into effect until everything updates, at which point notices will go out. The 30 day opt-out window for arbitration will go into effect at that point; we're reserving the option to extend the window should we determine a need to do so.
We will be GDPR compliant on May 25. Having everything complete (hub, all forms, etc) should fall within the same week. We'll make it as smooth as possible; a lot of work is going to be coming together at once.
Summary of privacy policy updates:
We'll encourage you to read the privacy policy (and will encourage you to browse the entire new legal hub) once they're public and accessible. The main changes to the privacy policy revolve around GDPR compliance. We're already very conservative and transparent when it comes to protecting your data and information; while the policy will have more legal phrasing, the gist of it won't change much. You get more granular control over how your information is used in a variety of ways, but the transparency remains essentially the same.
The GDPR is somewhat bold; more construction may be ahead.
So is our approach in extending the protection that it offers to all of our users. It's definitely the right decision morally, but the decision comes with practical benefits as well — having only one framework for how information is stored and handled leaves far less opportunity for error. But, since this is all sort of new territory, we're probably going to need to adapt as cases in courts around the globe set precedent post-implementation. We're going to be open and communicative about any changes and why we're making them.
We're open to questions, and expect many.
We're not going to try to anticipate a list of things we think you're going to want to ask, and write lots of text to those things. We'd rather just acknowledge that this post is probably going to leave you with at least one or two more questions than answers, and open it up to those questions.
Please, post anything not easily answerable in 200 something words as an answer, and we'll have a discussion under it if needed. Likewise, please help us help you by moving topics out of comments and into answers (or separate posts entirely if needed) if a topic becomes protracted so that valuable information doesn't get lost in the shuffle.
And remember, we're human, too.
42
and declare the purpose and value in the cookies policy to be "Anything" and "Everything" respectively. I'll get the lawyers working on that.