It's actually nothing to worry about. You as users end up with more protection, and companies like us are left in a place where we've got a framework for handling your information that puts much stronger guard rails around responsibility, transparency, and accountability.

The GDPR (General Data Protection Regulation) is a good thing, and not just for European citizens. While you've probably heard quite a few folks grumbling about it, including some of our own, we feel that it's a major step in the right direction and we're enthusiastically embracing it.

tl;dr; — There's going to be a new 'legal portal' launching on or just before the last week of May, 2018. You'll see a banner you can dismiss when it launches; we strongly recommend that you check it out. You'll also receive an email to let you know about the changes. We're expanding our privacy policy, providing a policy on cookies, and giving you ways that you can view and interact with data that we store about you. While this was done to be compliant with the GDPR, we strongly believe in the intent and spirit of the GDPR, and have extended its protection to everyone.

It's never a bad idea to get your legal documents in order so that folks can find them easily, and make use of any associated tools, but the landing of the GDPR is an especially fine reason to do that. So, we're rolling out what we call our 'legal hub', which will replace /legal on the sites; it's going to look a lot like this1:

So legal, it hurts.

1Note: The actual interface will likely vary from what's depicted; it's still a work-in-progress. Things like e-opt-out for the arbitration clause are likely to appear here, anchored links might appear or work differently, etc.

That's a bit different from what we currently have. Our goals in this update are to ensure we're fully GDPR-compliant, that the rights and protections afforded by the GDPR are extended to all of our users, regardless of location, and that all of the information anyone would want to know about our policies is as easy to find.

We've been rather proud of our plain English privacy policy that we created during a time when a common complaint was companies making such policies as difficult to understand as possible, which is a key reason that we were so eager to embrace the intent and protections of the GDPR. That sets our final goal, to make all policies as easy to read and understand as is legally possible, with as much transparency as possible.

The GDPR puts some pretty powerful new tools 2 in the hands of users to control their information:

Subject To Change

2Depicted implementation is subject to change, the legal hub and tools it offers are still being finalized.

.. and that's a great reason for every company to firmly get behind it. As we've said, changes are pretty reaching. We'll touch on some stuff, and then just open things to questions.

New cookie policy summary:

The cookie policy lets folks know about the types of cookies that we utilize, and why. It's broken down by product, or everything from Q&A to display ads, analytics and third-party cookies.

This policy is important because not only does it explain what cookies we set and why we need them, the process of explaining it and requirements to keep it updated help keep us mindful of how we use them as our distributed development teams continue to grow.

It's also neat if you just like poking around at how things work. Great things get built as a result of simply indulging curiosity.

Many product-specific updates:

There are a number of places where we need to mention Stack Overflow For Teams as a product (and one where we collect information about you). There's also stuff about Talent (formerly Careers), advertising products, and other things. There are many places where policies don't really change beyond what's needed for GDPR compliance, we're just adding more things that these policies cover.

Summary of ToS updates:

The first two items in our previous Terms Of Service update announcement are pretty unremarkable. To reiterate, we'll be specifically addressing some needs for Stack Overflow For Teams, and ensuring everything is compatible with the GDPR.

The final update regarding the arbitration clause will be amended to include two means of electronic opt-out (through email, as well as through a form on the site); snail mail will continue to work. All means of opting out will generate an indication that you’ve opted out, which could come in the form of an email reply, or a visual indication on a form that you’ve previously triggered it, provided that you have an account. If we can't correlate your request to opt-out to an actual profile, we'll just keep the request as notice that you've opted-out on file.

The arbitration clause in the new terms will not go into effect until everything updates, at which point notices will go out. The 30 day opt-out window for arbitration will go into effect at that point; we're reserving the option to extend the window should we determine a need to do so.

We will be GDPR compliant on May 25. Having everything complete (hub, all forms, etc) should fall within the same week. We'll make it as smooth as possible; a lot of work is going to be coming together at once.

Summary of privacy policy updates:

We'll encourage you to read the privacy policy (and will encourage you to browse the entire new legal hub) once they're public and accessible. The main changes to the privacy policy revolve around GDPR compliance. We're already very conservative and transparent when it comes to protecting your data and information; while the policy will have more legal phrasing, the gist of it won't change much. You get more granular control over how your information is used in a variety of ways, but the transparency remains essentially the same.

The GDPR is somewhat bold; more construction may be ahead.

So is our approach in extending the protection that it offers to all of our users. It's definitely the right decision morally, but the decision comes with practical benefits as well — having only one framework for how information is stored and handled leaves far less opportunity for error. But, since this is all sort of new territory, we're probably going to need to adapt as cases in courts around the globe set precedent post-implementation. We're going to be open and communicative about any changes and why we're making them.

We're open to questions, and expect many.

We're not going to try to anticipate a list of things we think you're going to want to ask, and write lots of text to those things. We'd rather just acknowledge that this post is probably going to leave you with at least one or two more questions than answers, and open it up to those questions.

Please, post anything not easily answerable in 200 something words as an answer, and we'll have a discussion under it if needed. Likewise, please help us help you by moving topics out of comments and into answers (or separate posts entirely if needed) if a topic becomes protracted so that valuable information doesn't get lost in the shuffle.

And remember, we're human, too.

  • 118
    Good to see that SO doesn't look reluctant to adapt to the GDPR :) – Denys Séguret May 17 '18 at 15:40
  • 19
    Will non-EU citizens be able to use the "tools"? – Sonic the Anonymous Hedgehog May 17 '18 at 15:48
  • 42
    Yeah! Does that mean I get to download all my posts and comments, including hidden ("deleted") ones, so that I can create my own full-text search on them? – Bergi May 17 '18 at 15:50
  • 50
    @rene Why would my account get deleted just because I request information? – Bergi May 17 '18 at 15:57
  • 42
    Yes, all tools will be available to everyone. Essentially, we're just adopting the GDPR as the law of the land, everywhere. This (1) is the right thing to do, and (2) eliminates multiple frameworks for how data is handled (the strictest way being the only way) which eliminates room for a lot of potential mishaps / mistakes. – Tim Post May 17 '18 at 16:31
  • 75
    @MEE We should probably always set the SuperSecretTrackingCookie to a value of exactly 42 and declare the purpose and value in the cookies policy to be "Anything" and "Everything" respectively. I'll get the lawyers working on that. – Tim Post May 17 '18 at 16:35
  • 36
    @Chloe offices don't matter. The GDPR not only applies to organisations located within the EU but it will also apply to organisations located outside of the EU if they offer goods or services to, or monitor the behaviour of, EU data subjects. It applies to all companies processing and holding the personal data of data subjects residing in the European Union, regardless of the company’s location. – Denys Séguret May 17 '18 at 18:33
  • 17
    @Chloe (1) Because SE thinks it's a good thing (read the post) (2) They can - you won't be able to legally offer your services in EU. – BartoszKP May 17 '18 at 19:16
  • 13
    @BartoszKP getting into a tangent, but "offer services in the EU" is a murky thing on the internet. Is SO offering a service in the EU, or are people in the EU accessing a service offered in the US? Pat on the back for SO complying instead of sticking their fingers in their ears and going "la-la-la America does not recognize that so we don't care", IMO – mbrig May 17 '18 at 22:16
  • 78
    GDPR is a good thing .... until you are a one man shop without the funds to hire lawyers.... then you just get to cry. and cry. and cry. – GiantCowFilms May 17 '18 at 23:24
  • 45
    @GiantCowFilms If a shop doesn't have the funds to handle customer data responsibly then what business do they have handling customer data? – Cronax May 18 '18 at 8:15
  • 16
    @ClaudiuCreanga My comment is on line with GiantCowFilms...this effectively puts out the little players of the market , and has incurred costs and responsabilities. My gov is exempting out of it on it´'s current legislature, and leaving up the decision and the onus to the people that will come next.... – Rui F Ribeiro May 18 '18 at 11:20
  • 12
    @BrianKnoblauch, I'm sure you wouldn't like it if some company (operating a website which you like and use) would geo-fence around your country. :p – Sorin Postelnicu May 18 '18 at 17:14
  • 19
    The worst part about this is that GDPR does not allow you to have a "share your personal data at your own risk clause." I don't feel its fair that it is now illegal to publish apps and websites with something as simple as an email login that don't have proper data compliance. I am fine with requiring fair warning, but beyond that is too much for small guys. Sure, Facebook, Google and other big companies need to be kept in line, but not by squashing the small guy. Even if the EU Decides its citizens are too dumb to asses risk, there should be a mechanism for foreigners to refuse to serve them. – GiantCowFilms May 18 '18 at 18:04
  • 21
    @AndreaLazzarotto GDPR does not require you to hire a lawyer or a DPO, but without a lawyer, there is little way to know how to comply correctly (and therefore you fail compliance - same result as if they required it). And its not just social networks. As I mentioned above GDPR covers data that all kinds of apps, games, and websites handle. I think one of the biggest misconceptions about GDPR is that it is aimed at the Googles and the Facebooks of this world. Its also aimed at the bloke who makes that mobile swiping game with a leader-board you play while waiting for your coffee. – GiantCowFilms May 18 '18 at 23:46

15 Answers 15


Our goals in this update are to ensure we're fully GDPR-compliant, that the rights and protections afforded by the GDPR are extended to all of our users, regardless of location

How does this apply to underage users? According to GDPR, a user has to be at least 16. Is this going to apply to users everywhere? That... would really suck, since I happen to like my account.

  • 5
    AFAIK no - the last I heard was that for non-EU users, 13 is still the minimum age; inside the EU it's 16. – ArtOfCode May 18 '18 at 9:08
  • 21
    @ArtOfCode That statement is directly contradicted by that the rights and protections afforded by the GDPR are extended to all of our users, regardless of location , which I guess is what Mith is seeking clarification on here – magisch May 18 '18 at 9:10
  • 19
    @ArtOfCode Outwardly and due to argument, the right for minors to be protected from companies processing their data is indeed a right and a protection under GDPR. Stack might not see it that way, but it's good for Mith to seek clarification on there, if only to have somewhere to point to or to get them to re-state policy more clearly. – magisch May 18 '18 at 9:14
  • 10
    I thought it meant that users under a certain age (be it 13 or 16) needed parental permission. Of course, if a company deems that to much trouble, they could resort to not allowing those accounts at all, but I don't think the GDPR requires that. – SQB May 18 '18 at 9:19
  • 4
    @SQB Is certainly correct, permission is required from guardians. Of course, a company does not have to allow that (for the obvious exception that a 16 year old cannot have an account on an adult site even with the permission of a guardian), so sites can change their rules to be 16+. I would be worried that Arquade's user base might be decimated if that were to happen, however. – Tim May 18 '18 at 10:51
  • 54
    The update will reflect that you need to be 13 years old, unless you live in the EU, which means we require you to be 16. However, there's nothing in the law that says we have to go proactively looking for underage users, which means the policy isn't any different from what we have, essentially. If someone says "I'm only x years old" and mods suspect the user might be underage, they just escalate it to us to investigate. A lack of action on our part is an indication that we looked, and found no grounds to delete the account. More about this in the latest mod newsletter – Tim Post May 18 '18 at 12:52
  • 16
    @allo Unless I'm very much misinterpreting the GDPR's wording, Stack Overflow does store personal data. Art. 4 of the GDPR considers "any information relating to an identified or identifiable natural person" to be "personal data". This comment is personal data. The votes I have cast are personal data. The history of flags that have been raised against your posts or comments is personal data. There may be legal arguments available that would allow Stack Exchange to permit child users without violating the GDPR, but "we don't store any personal data" is not one of them. – Mark Amery May 18 '18 at 14:31
  • 4
    @MarkAmery, your comments and votes are not personal data, are public data. You have just made them public by posting them PUBLICLY on the website. The personal data refers to your name, birthdate, address, email address, phone number, and any other information about yourself which you would prefer to not be known by someone else unless you explicitly allow them (and this includes the websites you visited, the movies you watched, the things you purchased, etc) – Sorin Postelnicu May 18 '18 at 17:18
  • 21
    @SorinPostelnicu Neither the definition I quote from Article 4 of the GDPR nor a plain English interpretation of words implies that something ceases to be "personal data" because it's published publicly. I also "PUBLICLY" display my real name here, yet it is very clearly data that is personal to me. Nothing whatsoever in the GDPR's definition even hints that "personal data" is limited to data which is sensitive or about which a person would have a reasonable expectation of privacy. – Mark Amery May 18 '18 at 17:25
  • 18
    @SorinPostelnicu: The Dutch national body just confirmed that Public Information (from Facebook in their example case) can still be Personal Information. The opposite of Public is Private. – MSalters - reinstate Monica May 18 '18 at 23:15
  • 7
    @TimPost would that mean that Mithrandir's account is theoretically in danger now if they've just admitted they're under 16? – numbermaniac May 21 '18 at 4:59
  • 5
    I agree that Arqade will die if this policy is enforced heavily. – The Mattbat999 May 21 '18 at 15:34
  • 2
    @RoryAlsop a plain English interpretation of point 1 at gdpr-info.eu/art-4-gdpr disagrees with you. – Mark Amery May 23 '18 at 22:08
  • 6
    In my humble opinion, this is a knowledge sharing platform. Kids who want to learn stuff can do so on the SE network. It is a huge educational benefit. Lots of stuff school ain't teaching them. This is where the older generation can pass things down to the younger. So, excluding gifted minors would be bad. I think SE should put some efforts in arranging parental permission instead! – Muhlemmer May 24 '18 at 9:38
  • 3
    @RoryAlsop That's not much of an answer. The GDPR states that "personal data" "means any information relating to an identified or identifiable natural person". So the only way that my comment could possibly not be "personal data" is if it's not "information", if it doesn't "relate" to me, if I'm not "identified or identifiable", or if I'm not a person. Whatever my faults, I'm pretty sure that I'm at least a person, and I'm "identified" by my name, clearly shown next to the comment, so which of the other two conditions are you claiming doesn't apply? – Mark Amery May 24 '18 at 16:12

Can we get an answer what will happen to European users with that arbitration clause? Since it's pretty clear that it's unenforceable for European users, and has no real merit here in the ToS.

Maybe in a form of an automatic opt out for European users? Or a header that it applies to US/Canadian citizens only? Facebook couldn't win with their arbitration clause in several European countries, so save yourself such a headache in Europe in a battle you're guaranteed to lose and opt out European users automatically out of the arbitration clause or make the arbitration clause more specific to the US.

So what's the game plan there with that clause?

See for reference this answer https://meta.stackexchange.com/a/310086/214343 and https://meta.stackexchange.com/a/310086/214343 .

Please take a look at SPArchaeologist's question Can we get an official statement about how the arbitration clause will be managed for foreign countries like European ones?

  • 1
    I have created a question just asking for this. Currently I am waiting for the new ToS to go public to check if those concerns where handled in any way, and I plan to update said question based on the outcome. That said, the more the merrier I shall add, another reminder that they have to take this in account at this point is indeed a good thing, so +1 I guess. We need all the visibility this issue can get. – SPArcheon May 18 '18 at 11:49
  • 7
    It's kind of hard to answer this without appearing to also offer legal advice to users, which is something I positively can't do here. What I can pretty confidently say without trepidation is opting-out of the clause will have no ill effects on anyone, it doesn't relinquish your right to seek arbitration, it simply stops forcing arbitration as your first recourse should a dialog with us directly fail to bear fruit. Whether or not that applies in the EU is something an attorney in the EU would need to tell you. – Tim Post May 18 '18 at 13:01
  • 6
    To answer your question directly, there's no future game plan that I know of, we're content with the clause as it is with the additional accommodations made to meet the community as best we could. I can't reiterate enough, we don't really fear entities that have invested time in our success. We've explained that trepidation mostly surrounds the sort of scary US legal climate, so .. I really can't speculate much more. I'll look at the linked questions. – Tim Post May 18 '18 at 13:04
  • 2
    Thank you for posting a reply. I appreciate the difficulty regarding international law where stuff get's murky fast, especially when keeping count of US and Australian high damages awarded in trivial cases. But having an answer at all as to the reason why there is no real statement is something :-) Thank's for taking the time to answer @TimPost I have already opted out, to prevent an eventual tug o war about how to handel a probaly not going to happen dispute where it should be handled. The email made it nice and easy. Thanks for the efforts on your side. – Tschallacka May 18 '18 at 13:19
  • 6
    You're more than welcome! :) I answered SPArcheologist's question to the best of my ability. I hope that's enough to put concerns to rest. – Tim Post May 18 '18 at 14:20
  • 1
    @Tschallacka my extremely limited knowledge of international law makes me think that in the unlikely chance bad stuff does go down, it'll go roughly like: EU court finds against SO and awards some damages -> go to US court to have judgement enforced -> US court points at the arbitration and jurisdiction clauses and tosses the judgement. – mbrig May 26 '18 at 3:54
  • @mbrig You forgot step 3. Stack Overflow / Exchange gets blocked in all of Europe due to contempt of court. – Tschallacka May 26 '18 at 5:25
  • 2
    @tschallacka I'll believe an EU country implements a nationwide IP block because of a foreign court judgement the minute I see it and not a second earlier. Especially if the judgment wasn't gdpr related and the laws haven't intentionally been harmonised. – mbrig May 26 '18 at 6:43
  • en.m.wikipedia.org/wiki/… – Tschallacka May 26 '18 at 7:00
  • 1
    @mbrig: You know what, if EU wants to be as stupid as blocking stackoverflow, fine by me. They're only hurting their own citizens. – Joshua May 29 '18 at 3:14
  • 1
    @Tschallacka hmm, so tons of individually fought court cases, leading to partial and inconsistent blocking by a bunch of countries with similar but subtly different laws? Yeah, that's fully what I expect. – mbrig May 29 '18 at 3:35

Does a portability request also include data that is personal to specific users but you may not want to share (e.g. moderator annotations, suspension histories, internal notes on an account, etc.)

So can a user request those? If yes, how do you protect yourself against users abusing this to bypass existing checks and balances and cause drama?

  • 4
    The goal here is to give the user as much as possible without (1) revealing anything proprietary and (2) revealing any third-party information. We would treat moderator annotations (more often automatically raised by the system these days) as proprietary. The purpose of portability is so the account can be recreated on another platform so we might export the fact that it is suspended, and a number representing a point in an enumerated list representing broad reasons why, but that's it (but we currently show this publicly anyway, so folks aren't seeing anything new). – Tim Post May 18 '18 at 13:38
  • 6
    But general disclaimer: Our interpretation of the law can change as stuff inevitably gets litigated, so we're going to watch closely to see how rulings set precedence, which means a whole lot of stuff just got a whole lot more subject to change. However, in this case .. I don't think it's likely to change. – Tim Post May 18 '18 at 13:39
  • 10
    This is indeed a good question, and not necessarily related to the portability request. A user has the right to ask the company ALL the personal information they store about him/her. Depending on the legal interpretation, this might include things such as the "intelligence" the company gather on the user (such as the user's behaviour on the website, or any user activities flagged as suspicious). Or I don't know, maybe the GDPR did not go THAT far in protecting the users' rights... – Sorin Postelnicu May 18 '18 at 17:24
  • 1
    @SorinPostelnicu For GDPR you have to disclose how you handle users data "automatically", and for what purpose. As such, collecting user data to feed targeted adverts would count as automatic processing, would have to be detailed in the StackOverflow's GDPR policy, and should be request able by users (unless proprietary) – SGR May 22 '18 at 7:46
  • 9
    Does GDPR really allow you to declare that data on users is "proprietary" and therefore cannot be released? Even if it is opinions about the behaviour of those users? What does "proprietary" mean here, except we do not want to release it in case the user complains ["causes drama]? IANAL but AFAIK a primary intention of GDPR is to force companies to release such opinions so that users can be informed and, yes, complain. Especially if opinions are "raised by the system" i.e. decisions made about a person automatically by an algorithm. – MarkJ May 24 '18 at 11:20

Will Stack Exchange treat a disclosure request as a hostile action? I've seen some websites that do allow these requests (by nature of that being the law and all) but will suspend / delete your account if you do so, to disincentivize users from using these for non serious reasons.

Outwardly, if you didn't do this, malicious actors could waste a metric ton of staff time by repeatedly filing obscure disclosure requests.

Is there any such policy planned on Stack Exchange?

  • 1
    Surely this is explained in the policy? – Tim May 18 '18 at 10:49
  • 17
    We are not treating those as hostile at all. Every effort will be extended to make these requests as self-service as possible, were we can just give folks links to get at the information they want whenever they want it. I'm sure there will be cases where people will need extra help or (for whatever reason) demand we pack it up and give it to them - we'll do our best to make people happy, and probably need to build out tools as we see what the most common needs and use cases will be. But they won't ever be treated as hostile, that's just wrong on many levels. – Tim Post May 18 '18 at 12:46
  • 21
    I mean seriously, if you're worried about the amount of work .. let people get it themselves without your help for the most part - invest a bit of energy to save a lot of work. Trying to save work by saying "If you exercise your rights we're going to do mean things to you" is, in my personal view, antithetical to the spirit of the regulations. What good are rights if entities can intimidate you from using them? If you make it self-service, millions of people wanting to see their stuff won't cause you to even break a sweat. – Tim Post May 18 '18 at 12:49
  • @TimPost I don't disagree, I just saw this in a bunch of places and wanted to make sure. Some websites treat a GDPR disclosure request the same as if you sued them (hostile legal action against the company). After all this answer and your comment on it can now be used to assuage fears to that effect. – magisch May 18 '18 at 12:50
  • 20
    @user5389107 Can you give an example? I've never seen such a thing, and I would guess it would be illegal as well. – Bergi May 18 '18 at 14:27
  • @Bergi It's probably not illegal in the sense of "you are committing a crime if you do so" but I'm pretty sure, if you can sue a company doing so in front of a European court, the company is very likely to lose that trial and court will rule that they must not apply any negative effects to users that just make use of rights that have been granted to them. Otherwise it would be like saying "You have the right of free speech, but if you make use of it, we wait until your speech is done and then we put you into jail". Using your rights must never cause negative consequences IMHO. – Mecki May 28 '18 at 11:24
  • 2
    @Mecki consequences from the government and consequences from private citizens/corporations are rather different things though. Somebody spouting off racist remarks may not go to jail, but I don't have to do business with them... – mbrig May 29 '18 at 3:38
  • 1
    I don't want to name names, but some organizations thought 'treat as hostile / terminate rights to use' was as good of a strategy as 'well, we'll just block the whole EU, no big deal' from what I read. I didn't see anyone threatening to remove accounts, but did see some scary language about "forfeit all rights to use" from some shady places, which obviously didn't fly. Lawyers write scary things anticipating that nobody will have the time or patience to actually test them in court, but it doesn't make those things legal. The GDPR has really caused the scum to rise to the top for skimming :) – Tim Post May 29 '18 at 13:51
  • And it's a good thing none of those shenanigans had a chance, too, because folks would have hated to lose all rights to whatever happened to be in their refrigerators. – Tim Post May 29 '18 at 13:52
  • @mbrig Where did I mix those two up? I only said in reply to "would be illegal as well" that it would not be illegal. So there are no consequences from the government to expect. But if you do that, be prepared to expect consequences from your users, at least if they have the ability to sue you in the area of validity of the GDPR. That you can freely choose with whom you want to do business is not entirely accurate all over Europe (e.g. you could violate anti-discrimination laws that way). – Mecki Jun 1 '18 at 9:59
  • @Mecki you're conflating them when you compared a company punishing users for exercising their rights to somebody exercising rights to free speech and being put in jail. – mbrig Jun 1 '18 at 14:41

How will GDPR work with our existing moderator tools to handle bad actors? Currently, the system can detect if accounts are recreated and extend a suspension to the new accounts automatically. If a user requests erasure of such an account, do we lose this automatic protection?

  • 6
    We looked, and we don't see any impact on the tools. Stuff that tracks recidivism, or bad actors cycling through accounts, or spammers hopping subnets like giant snow shoes all falls under the realm of proprietary as far as information goes. I'd like tools to get to the point where more stuff is automatic (and less human time spent combing through data to spot things), but that would be on top of already being good as far as compliance goes. – Tim Post May 18 '18 at 17:28
  • 5
    The GDPR does not provide a blanket right to get everything about you deleted, the right of erasure is not absolute. If SE has carefully considered things, than information like that can likely be retained under 'legitimate interest'. See also ico.org.uk/for-organisations/… – Mark Rotteveel May 20 '18 at 12:15
  • 2
    @MarkRotteveel that is correct, assuming SE in advance in privacy policy divulges what information it will keep after receiving erasure request, and for what reason (under what GDPR rule). – Matija Nalis May 26 '18 at 11:42

In what ways do the three GDPR requests for portability, erasure and rectify differ from the already existing tooling in those areas?

For portability, there is already the data dump, the API and SEDE. Will there be additional information available with a portability request that we currently can't get?

For erasure we have the options to delete your entire account, and to request disassociation of individual posts. I assume that it still means that you can't remove your content entirely from the site, as it is still CC-licensed? Can removal requests be targeted very precisely, e.g. for specific types of data SE stores?

I can't really think of any case where the right to rectification would come into play on SE, as most personal data is editable by the user themselves.

  • 26
    Data erasure in the GDPR is for personal data. Answers and questions shouldn't be concerned, just like posts in a forum aren't concerned as long as they don't contain personal data. – Denys Séguret May 17 '18 at 16:33
  • 14
    The new tools will allow very precise requests. Say, for instance, we stored your email address in metadata for some kind of object so that we could correlate it to something else. You could request removal of that, which might result in us coming back and saying "Okay, but that also means losing public credit for creating it due to how the system works" -- I think the main point is you'll at least have the option. But you're correct, there are, I think, less than 10 places where this might be a real use case on Q&A. Possibly more for Talent/Jobs though. – Tim Post May 17 '18 at 16:40
  • 5
    @DenysSéguret I'm not entirely sure about that, the definition of "personal data" in the GDPR is rather vague. It's also not the same as PII, as far as I understand, which is a more restrictive definition. – Mad Scientist May 17 '18 at 16:41
  • 12
    PII - "Who you are", Personal Information - "what we know about you". Now, what we know about you often includes who you are, or (for us) is easily correlated. So explaining it and making it transparent isn't hard, it's just exhaustive. For large ad networks where all you are to them is a collection of thousands of session identifiers ... oh I so do not envy the tasks they're (hopefully) wrapping up. I definitely do not envy them. – Tim Post May 17 '18 at 16:48
  • 1
    There's always the possibility you put some personal information in a question, answer, or comment by mistake (e.g. identifying the real name or email address of another user) and you or the other user wants to correct that. GDPR says you must be able to do that. – Michael Kay May 17 '18 at 17:14
  • 1
    @MichaelKay Posts can be corrected and the incorrect information redacted so it disappears (even from the edit history). This happens already. Comments can be edited, but I don't know whether the edit history can be redacted. – Andrew Leach May 17 '18 at 17:43
  • 2
    @AndrewLeach close - but now think about the public data dump. ;-) – Brent Ozar May 18 '18 at 10:59
  • 4
    @MadScientist While I agree that the definition is potentially vague, I don't see what's vague about this particular case. Comments, flags, votes, posts, edits, and review actions all very clearly "relate to" the particular individual who posted or performed them, and so are "personal data". However, a little Googling suggests that it's permissible to satisfy an erasure request by anonymising data, instead of by deleting it outright, so the site's existing ability to delete an account while leaving anonymised posts and actions behind should be adequate or near-adequate for compliance. – Mark Amery May 18 '18 at 14:42
  • From what I've read about the GDPR, "portability" is about requestion all your data in a format that you can use in any way you want, including uploading it to another place, The existing tools don't really allow to do that. – Ismael Miguel May 18 '18 at 14:45
  • 1
    @TimPost meta.stackexchange.com/q/155901/200582 looks to me like something you probably need to implement if you want to satisfy the Right to Erasure requirements (assuming that anything associated by name with a Stack Exchange account is considered "Personal Data", which is my interpretation; I'd be interested to hear if SE agrees with that). – Mark Amery May 27 '18 at 22:19

How does the system deal with consent?

You'll see a banner you can dismiss when it launches; we strongly recommend that you check it out. You'll also receive an email to let you know about the changes. We're expanding our privacy policy, providing a policy on cookies, and giving you ways that you can view and interact with data that we store about you. While this was done to be compliant with the GDPR, we strongly believe in the intent and spirit of the GDPR, and have extended its protection to everyone.

It is my understanding, that this kind of consent gathering (through inactivity) is not sufficient.


This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data.


Silence, pre-ticked boxes or inactivity should not therefore constitute consent.

Are sites automatically opting-out of all consent requiring activities until consent is gathered?

See also: https://gdpr-info.eu/recitals/no-32/

Or as the privacy authorities put it in their Article 29WP Guidelines on Consent under Regulation 2016/679:

Silence or inactivity on the part of the data subject, as well as merely proceeding with a service cannot be regarded as an active indication of choice.


What about IP address logging?

IP addresses are specifically defined as personal data per Article 4, Point 1; and Recital 49 of the GDPR. If StackExchange is complying with this new regulation, they can no longer even log this information.

How is that going to affect moderator tools and spam fighting? Logged IP addresses seem to be a necessary tool for fighting spam here. If that goes away, I fear a spam flood.

  • 9
    IP addresses are not always PII - only if they can be connected to a real person. That might or might not be possible in logs, depending what data actually gets logged. – ArtOfCode May 19 '18 at 11:49
  • 3
    @ArtOfCode Could you please link me to source, where this is discussed? I was wondering about the way to compliantly store IP addresses for security reasons (e.g. to be able to notice that some IP is range scanning the site, and similar). – FanaticD May 20 '18 at 8:25
  • 7
    @FanaticD That was straight from the text of the GDPR itself, actually - see point 1, Article 4. An IP address is an "online identifier"; "personal data" must relate to a natural person; thus, only if the IP can be associated with a person or user is it personal data. – ArtOfCode May 20 '18 at 16:33
  • 1
    I believe there may be a clause (I'm most definitely not a lawyer, check for yourself) that allows the collection of personal data like IP Addresses if the data controller (the website operate) has to do so in order to secure their computer systems. (source: ctrl.blog/entry/gdpr-web-server-logs) – GiantCowFilms May 20 '18 at 17:33
  • 2
    @ArtOfCode From server side, you don't know which IP ranges identify persons. As much as for SMTP (or some other specific services) you can safely assume they almost never do, in a general case you need to anonymize every IP except a handful of known proxy addresses (especially for http). Some IPs, even if surname is unknown, easily identify people: some providers assign semi-static IPs and some people live alone. – kubanczyk May 21 '18 at 8:16
  • Of course some IP ranges are known to be completely outside EU (outside RIPE). – kubanczyk May 21 '18 at 8:24
  • 1
    @kubanczyk Sure, but that's not the operative point of it. I myself have a static IP; given it and that knowledge and a statement that it's mine you could identify me. It needs that statement, though - otherwise it could still be anyone's. Same applies with logged IPs - unless you also store other information that allows you to connect the IP to a person, you can't trace it back to an individual. – ArtOfCode May 21 '18 at 12:03
  • 1
    @ArtOfCode If the logs containing your IP leak, it betrays facts about your activities. Bad people can mix this leak with other data, you can't control them. Bad people can safely assume that single IP points to a single person and adjust that later. It's not different than name/surname data. – kubanczyk May 21 '18 at 12:36
  • @kubanczyk Not quite. If the logs leak, it betrays facts about that IP's activities - not mine. Only if you have some other way of linking that IP to me does it become personal data because it relates to a person. – ArtOfCode May 21 '18 at 13:30
  • 1
    @ArtOfCode The logs containing 'John Smith' possibly involve many persons named as such. But GDPR does regulate it. Exactly the same with IP. – kubanczyk May 21 '18 at 13:34
  • 1
    @kubanczyk No, it's not. Names are a primary human identifier. IP addresses are a digital identifier that always requires more work to link them to a human. There's a difference in how they're treated. However, these comments are probably not the best place to continue this discussion, so I'll leave it there. – ArtOfCode May 21 '18 at 14:46
  • 3
    This is hard to answer in just one question. The SPAM system operates entirely differently (and on a different level from) the mod tools that help suss out rings and such. In either case, it's a legitimate business interest to collect the info for express administrative / anti-spam purposes, and quite a bit of the analysis we do subsequently would be considered proprietary, and (in many processes) anonymizes the IP info anyway. However, some of this info would be within the scope of a SAR, and we'd produce it (or remove it, if applicable). – Tim Post May 21 '18 at 17:07
  • 2
    But, patterns of doing this to avoid abuse detection would quickly become obvious, and it's well within our right to ask someone to simply not come back if we have firm reason to believe they're here in bad faith (but this isn't new at all). – Tim Post May 21 '18 at 17:07

How does this pertain to questions and answers that contain personal user information, on say a site like IPS. If a user files an erasure request while having some of those, is that user entitled to also have them removed?

  • 3
    You mean in cases where someone inadvertently posts personal information? We already scrub that (permanently) if we see it, but a framework to handle it in cases where we weren't alerted to it by site moderators is already available to users outside of the new GDPR compliance (they only need to contact support, and we can redact entire revisions). – Tim Post May 18 '18 at 12:38
  • @TimPost no I mean in cases where the nature of the answer itself is personally identifying. For instance one of the questions I answered about being discriminated against on IPS. Even if you disassociated my account from that, unless you also scramble the # you put after "user" in the attribute, someone could correlate similar answers of mine on that site and identify me. – magisch May 18 '18 at 12:42
  • 10
    @user5389107 - GDPR does not mandate data protection to that level. In reality, as any good hacker will tell you, with a certain amount of activity (or poor Opsec) you are identifiable anyway. At some point the responsibility is on you as a user of a site where all the posts you make are public to ensure they are appropriate. SE does what is required of them to redact, but they can't stop people who want to post a range of questions uniquely identifying them... – Rory Alsop May 18 '18 at 13:05

We've been rather proud of our plain English privacy policy that we created during a time when a common complaint was companies making such policies as difficult to understand as possible, which is a key reason that we were so eager to embrace the intent and protections of the GDPR

That's a good thing! But as I user, I struggle to find the differences between what's was on the page (say last month) VS what's live now.

Could we have an edit history like we have for Q&A edits in order to have a real idea of each changes over time?


You talk about portability, but what about Subject Access Request (SAR). As I understand it submitting a SAR requests any and all data that I am linked to. This might be a chat message that mentions my name, or leading on from this post it might be a hidden moderator comment or email sent within SE that is linked to my profile or is about me personally.

Other people's privacy can be protected, in the case of an email you can redact the name of the persons involved but the content should be made available.

  • 5
    You'll have specific tools to get to that sort of stuff live in most cases, because outside of ensuring you're authenticated, there aren't really any other concerns on our part about you getting it. Where third party information comes into play, it might have to kick off a request where background processes and a final human reviewer makes sure stuff is anonymized properly as needed, and anything truly proprietary is taken out. Most account annotations would be treated as proprietary, but some finalization remains to be done there. – Tim Post May 18 '18 at 16:13

One aspect of the Public versus Private Terms really confuses me.

If you’re using the Public Network you apply the Public Network Terms, and if you’re using the Private Network you apply the Private Network Terms:

Public Network Terms

... These terms govern the use of the public Network (the "Public Network Terms"). ... your use of the private Network is governed by the Private Network Terms.

Private Network Terms

... These terms govern the use of the private Network (the "Private Network Terms").

All fine and good, until I get to:

Public Network Terms

... These Public Network Terms ... governs [sic] your permitted use of the public Network ONLY, including any Services or Products that are part of the public Network (e.g., the private Network). [Emphasis added]

This sentence states that the Public Network Terms apply ONLY to the public Network, and therefore they do apply to the private Network, because it is part of the public Network. It seemingly contradicts itself and the earlier statements.

Perhaps not what was intended, but that is what it says. The sentence also contains a grammatical error – that's often a sign that a sentence has been reworked. Did an edit cause a regression, breaking the intended meaning?


How fine control you are going to give when it comes to data erasure?

Will you allow to erase linking between profiles on SE sites, or in case of 'regretted' linking, erasing one of those profiles will be necessary?

Will you provide a canonical answer (FAQ) how to erase profile? I've found nothing for Area51, for example.

Will the anonymisation allow breaking links between posts within one side (to make it impossible to easily find out, they were posted from the same account)?

  • 1
    We already provide a means to remove one (or all) profiles entirely (it's in the contact form), and you can request that any specific post that you wrote be disassociated from your account (but this is already the case through creative commons). You can also 'hide' communities from showing up in your profile. Have you seen the help center articles around account functions? I think all of what you want is already implemented, just the documentation of it was hiding from you. Do you have more specific questions? – Tim Post May 24 '18 at 15:06
  • 1
    @TimPost I know I can hide an account, but they remain linked nevertheless (I'm logged in to all of them, I see them in 'your communities'). It might be so, that many things are there, but are hard to find or are not very intuitive. – 9ilsdx 9rvj 0lo May 24 '18 at 15:23

Can I share my PII information in my SO profile/about me description? Will it be prohibited?

  • 7
    No. The GDPR is all about giving you control over how your information is used. General advice about posting your personal information in public places (like your profile) aside, nothing prevents you from doing what you want with your info, it belongs to you :) We don't permit posting of this in answers / questions / comments, but what you write on your profile is broadly up to you, as long as it doesn't cause a disruption. – Tim Post May 23 '18 at 14:39

I have just been looking for the new tools, all users shall get and I think the request site is quite hard to find.

Could you please add something to the contact form, maybe a dialog as you already do for Why was my question or answer denied?: I want to submit a request regarding my personal data.

I want to submit a request regarding my personal data.

Requests to obtain, erase or rectify personal data shall be send using our legal portal.

You can click on Submit a request to be redirected to the form where you can submit this type of request.

No thanks, continue     Submit a request

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .