-17

Quote from this comment (posted by balpha ♦):

... While the publicly visible behavior is like you don't have hats (e.g. it's not visible on your avatar, you don't count towards the site leaderbords, etc.), the fact that you deserve the hat is recorded for all users, regardless of opt-out status. So once you opt back in, the hats are immediately there.

If that's indeed the case (I trust somebody like balpha ♦ does know), then I wonder about this part of it: "the hat is recorded for all users, regardless of opt-out status". I.e. isn't that a violation of at least these GDPR rules:

  • Something like "do not track me" seems to not apply (even if you opted-out, the recording continues).
  • The default for opt-in/opt-out is that everybody is opted-out, and any user needs to explicitly opt-in (a user who does not want to participate in Winter Bash, must indicate I hate hats).
|improve this question
  • 3
    Just about everything you can do to get a hat is already public information, so anyone knowing that you got the had could have known that even if the list of hats someone had gotten wasn't visible to them. In other words, by agreeing to show others your posts, comments, reviews, edits, vote aggregates, etc., which you must do to participate at all, you've already made all of this data public. – Servy Dec 21 '18 at 19:21
  • 1
    I suggest we stop this whole WinterBash right here and now before we get into trouble with the EU. – rene Dec 21 '18 at 19:23
  • 4
    If they've already opted in to the site as a whole and have an account - does that even apply? – Catija♦ Dec 21 '18 at 19:30
  • @Catija who do you mean with "they" ... ? – Pierre.Vriens Dec 21 '18 at 19:35
  • I think hypothetical GDPR covered user. That said, isn't a hat just a time limited badge? If there needs to be explicit consent for hat related information.... the same would need to be true for badges – Journeyman Geek♦ Dec 21 '18 at 19:53
  • Related: worldbuilding.stackexchange.com/questions/114033/… – Shog9♦ Dec 21 '18 at 19:54
  • I don't think the hats collect any user information on top of what is already collected when you make an account. How do the hats track you? – TheWanderer Dec 21 '18 at 23:41
13

The Stack Overflow Public Network Terms of Service states in point 5: User Obligations (emphasis mine):

To access some of the public Network features you will need to register for an account as an individual and consent to these Public Network Terms. If you do not consent to these Public Network Terms, Stack Overflow reserves the right to refuse, suspend or terminate your access to the public Network.

To participate in Winter Bash you have to have registered for an account, and thereby agreed to your data/public behavior being used/displayed in this way.

So yes, Winter Bash is GDPR compliant, as it is part of having a user which you opted-in to at some point.

|improve this answer
  • You're probably right for those who want "To participate in Winter Bash". But what about those who do NOT want "To participate in Winter Bash"? Moreover, are you aware of anything in those ToS that mention anything about Winter Bash? – Pierre.Vriens Dec 21 '18 at 19:57
  • 8
    @Pierre.Vriens It's really not necessary. You're taking the "opt-in/-out" thing way too seriously. Think of it more like a setting. Winterbash is turned on or off for you, and the only thing the setting does is determine whether or not the stuff is shown to you. Similar to how "opting out" of unread inbox emails is really just a setting for whether or not an email should be sent to you. The data that runs both of those things still exists - the setting just means you don't care to see notifications about that data. – animuson♦ Dec 21 '18 at 20:05
  • @animuson I know/agree it is a setting, labeled "I love hats" or "I hate hats". But my point (real question) is that according to GDPR, its default might be wrong. I assume SE prefers "I love hats" to be the default, but GDPR might not agree with that default. – Pierre.Vriens Dec 21 '18 at 20:17
  • 8
    @Pierre.Vriens The "default" is completely irrelevant here. Whether or not we show you hats on top of the page has absolutely nothing to do with anything that GDPR covers. The data that is behind the scenes regardless of whether you see hats is already covered by the terms of service. – animuson♦ Dec 21 '18 at 20:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .