6

The Terms of Service contains the following snippet:

If you are located within the European Union, you must be at least 16 years old to access or use the Network or Services, including without limitation to complete a Stack Overflow Account Registration.

Does the phrase "located" mean physical location at a given point, or does it mean the user's "home" location?

In other words, if I'm, say, 14 years old, and have a legal residence outside of a European Union member country (and thus subject to the standard worldwide age threshold of 13), and I visit an EU member nation on a temporary stay (e.g., vacation), does this mean that my account is now liable to be deleted as underage since I'm now physically located in the EU and I'm under 16?

Improve this question
6
  • 4
    This question is off-topic because it is not about an actual problem that you experienced while using a Stack Exchange site.
    – Cody Gray - on strike
    Nov 16, 2019 at 8:25
  • 1
    ...however, I guess a decent answer to this question needs knowledge about underage protection laws in the european union (since I guess that's the reason for the different age limits in different areas of the world). Experts for this may be found on Law.SE.
    – Doc Brown
    Nov 16, 2019 at 9:42
  • 2
    @CodyGray Are questions only on-topic here if they are about things currently affecting the user asking the question? That doesn't make sense to me. What if OP has a young friend (or niece/cousin/child/etc) who wants to use SE but whose family travels a lot? Then this issue affects that (potential) user, even if it doesn't directly affect the user asking the question on their behalf.
    – Kyle Strand
    Nov 16, 2019 at 11:59
  • 1
    (and of course, if you're only allowed to ask about things affecting you directly, that would make a lot of recent posts about a certain situation off-topic...)
    – Kyle Strand
    Nov 16, 2019 at 12:00
  • 1
    Concocted, artificial scenarios tend to make for poor questions, @Kyle. If there was some motivation like the one you suggest, then that would be enough for me to reconsider. At that point, the asker could give details and respond to clarification questions in a meaningful way.
    – Cody Gray - on strike
    Nov 16, 2019 at 12:04
  • 4
    @CodyGray I don't consider this particularly concocted or artificial. Lots of children travel into and out of the EU during their teens.
    – Kyle Strand
    Nov 16, 2019 at 12:08

4 Answers 4

Reset to default
6

IANAL, but I have created eLearning materials on GDPR based on the advice of subject matter experts who were.

I suspect that the answer is probably no, users aged 13 - 16, who are based outside of the European Union (EU), probably cannot use SE while travelling to an EU member state.

It is my understanding that while in the EU, you will be subject to the General Data Protection Regulation (GDPR).

Any changes to personal information while there would therefore be covered by those regulations.

Article 8 of Chapter 1 of the GDPR states that personal info can only be collected from persons under the age of 16 (not just EU citizens under the age of 16) with parental consent.

Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.

[Point (a) of Article 6(1) simply states that:

  1. Processing shall be lawful only if and to the extent that at least one of the following applies:

(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;]

SE has no way to verify that parental consent has been given, and so would - in common with most tech companies - presumably err on the side of legal caution in such cases.

You might also be interested in the related Meta:SE question: Why can't I use Stack Exchange if I'm under 13 years old, and is there any way I can use it legally?

Improve this answer
11
  • 1
    This is Wikipedia quote, so I don't know how accurate it is... "The General Data Protection Regulation (EU) 2016/679 (GDPR) is a regulation in EU law on data protection and privacy for all individual citizens of the European Union (EU) and the European Economic Area (EEA). It also addresses the transfer of personal data outside the EU and EEA areas." So if you are not an citizen then it does not apply to you. GDPR might also apply to residents... but traveling does not make you a resident.
    – Resistance Is Futile
    Nov 16, 2019 at 10:57
  • 2
    @HerMajestyQueenofARC With all due respect to Wikipedia, the title of the GDPR (see the 2nd link in my answer above) is "on the protection of natural persons with regard to the processing of personal data and on the free movement of such data". The scope of the regulations is not limited to EU citizens, but covers everyone within the legal jurisdiction of the EU.
    – sempaiscuba
    Nov 16, 2019 at 11:06
  • 1
    It is a bit more complicated... it means that EU based entities that collect data cannot discriminate between EU and non EU citizens. SE is not EU based entity, so GDPR only applies to collecting data from EU citizens (and possibly residents). If what you say would be correct then individual states would not be able to have different age requirements when it comes to children.
    – Resistance Is Futile
    Nov 16, 2019 at 11:32
  • 2
    @HerMajestyQueenofARC As I said, IANAL. We were told simply that "if the data subject, or the entity collecting the data are within the EU then the provisions of the GDPR apply" (see Article 3 of GDPR - Territorial Scope). Different states within the EU have different age restrictions for a variety of purposes, so there is no reason why the GDPR would be any different.
    – sempaiscuba
    Nov 16, 2019 at 11:38
  • IANAL, too... if in the Union is applied to travelers then SE would effectivelly be breaking the GDPR for every kid that is travelling in EU regardless of whether SE is used during that period, since GDPR is not about using services, but collecting data and SE already has collected data.
    – Resistance Is Futile
    Nov 16, 2019 at 11:50
  • @HerMajestyQueenofARC I suspect that is probably not the case, since SE would not be gathering any data if the kid doesn't log in during that period. However, since even tracking cookies are covered by GDPR (that is exactly the reason that so many organisations outside the EU just blocked access to IP addresses within the EU when GDPR was introduced), those might be an issue depending on what data they are collecting.
    – sempaiscuba
    Nov 16, 2019 at 12:00
  • 1
    I guess we need a lawyer ;)
    – Resistance Is Futile
    Nov 16, 2019 at 12:05
  • 1
    @πάνταῥεῖ That makes two of us. But I am not typing all that so acronym it is.
    – Resistance Is Futile
    Nov 16, 2019 at 12:06
  • @HerMajestyQueenofARC I sat in a room with specialist lawyers for longer than anyone should have to when I was creating that eLearning resource. I have a lot of sympathy with Gibbs' Rule 13! However, what I have said here is based on my understanding of what was said in those meetings. Ultimately, what we probably need is someone from SE to state what their interpretation of the GDPR regulations is.
    – sempaiscuba
    Nov 16, 2019 at 12:13
  • @sempaiscuba Well, gathering personal data applies in 1st place when creating an account. Posts are not considered personal data.
    – πάντα ῥεῖ
    Nov 16, 2019 at 12:21
  • @πάνταῥεῖ It also applies if you change any of that personal data (which is what I said in the answer). Further, tracking cookies also gather data for "the monitoring of their behaviour as far as their behaviour takes place within the Union" to quote from the regulations, so they would also be a potential issue. However. I am aware that some aspects of that have yet to be tested through the court system (tbh I don't think I understand enough about the situation as it applies to tracking cookies, which is why I didn't include it in my answer).
    – sempaiscuba
    Nov 16, 2019 at 12:38
4

An answer applicable to more than this specific question is: everything must be legal on both ends of the connection, and often at points in-between. Something can't be legal (or not pursued) on one end of the connection (your end or our server's location) but in any way illegal on the other end.

The points in-between issue is a little different, the routers in intervening countries may DPI and reject the traffic, causing it to be rerouted, with no avenue to pursue an arrest warrant at either end. In rare instances you may have problems if you decide to visit that country in the future.

Specifically, in regards to this question, people need to be legal age on both ends of the connection. The most restrictive condition supercedes the lesser restrictive ones.

This answer applies to more than simply to this site but to the whole Internet, you need to obey the law where you visit unless you want to risk the penalty. For example you wouldn't be able to buy guns from somewhere where Internet gun sales are legal and have them shipped to a country where firearms are prohibited, proclaiming that you had purchased them legally and therefore are entitled to have them.

Improve this answer
1
  • This has nothing to do with law. This is about specific and very simple statements in the Stack Exchange Terms of Service.
    – Lightness Races in Orbit
    Nov 16, 2019 at 21:41
2

It depends per member state and their laws. EU members are free to set their limit age anywhere between 13 and 16, according to the EU Agency or Fundamental Rights:

According to Article 8 of the GDPR, when processing personal data in relation to information society services offered directly to children under 16, consent shall be given or authorised by the holder of parental responsibility. Member States, however, may provide for a lower age, not below 13 years. In the framework of the regulation’s transposition, some Member States have already taken positions regarding this issue. These countries are listed below, with the information in parentheses indicating whether this is provided for by law or specified in a draft law.

  • 13 years: the Czech Republic (draft law), Denmark (draft law), Ireland (draft law), Latvia (draft law), Poland (draft law), Spain (draft law), Sweden (draft law), the United Kingdom (law)
  • 14 years: Austria (law), Italy (draft law)
  • 16 years: Germany (law), Hungary (draft law), Lithuania (draft law), Luxembourg (draft law), the Netherlands (draft law), Slovakia (draft law)

So technically, some EU visitors may access SE at a younger age than the default 16 in the GDPR. Whether SE is going to accommodate for this is a second question. It seems unlikely, since they also don't bother allowing minors to get their parents or guardian to give consent which would often allow them to participate.

The contributions of minor users are probably too insignificant to SE's revenue. And even if they delete an account, they get to keep the goodies (posts, comments, other contributions). All they have to do is delete the user, which is very cheap. So there's little incentive on their part to add a procedure for getting consent, which they argue is "complicated and not worth the effort" (in the US case).

Of course, it would be nice of them to accommodate for younger users by implementing a procedure for obtaining parental consent. Especially consider SE's attempt at inclusiveness. As SE employees put it:

I’m here nearly a decade later because I believe we can continue to build this community together and make it an even more welcoming and inclusive place than it is today.

Improve this answer
4
  • 3
    Stack Exchange has decided to enforce a rule of 16 EU-wide in their Terms of Service rather than take into account laws of specific member nations.
    – Sonic the Anonymous Hedgehog
    Nov 16, 2019 at 17:44
  • The rules of the GDPR are irrelevant. The question is about the Stack Exchange Terms of Service.
    – Lightness Races in Orbit
    Nov 16, 2019 at 21:41
  • 1
    @LightnessRaceswithMonica the GDPR is the law of the land, and its "rules" must be followed by SE just as it must be followed by the Googles and the Facebooks. The question is about EU, mentions the exact age limits from the GDPR (at least the original text), so I fail to see how the GDPR is irrelevant. TOS rules that contradict laws, otoh, are irrelevant.
    – thebjorn
    Nov 16, 2019 at 23:38
  • 1
    @thebjorn The ToS rules do not contradict any laws, and I never claimed that they do. Quite the contrary: SE have made it more strict, by banning all use of SE from within the EU by individuals under the age of 16, so that they do not have to deal with the complexities of a less-draconian rule in the GDPR legislation. The question is not about the GDPR legislation, but about the wording of the SE ToS. One inspired the other, probably, yes, but they are two different things. Honestly I'm unsure why everybody's having such a hard time understanding this. It's straightforward.
    – Lightness Races in Orbit
    Nov 17, 2019 at 1:41
-5

"Location" means "where you are".

You are not permitted to access Stack Exchange from within the European Union, while you are under the age of sixteen.

That's it.

Improve this answer
2
  • 1
    @JJforTransparencyandMonica No elaboration is necessary. There's no "guess". The Terms of Service passage is plain, simple, basic English. That's why my answer is quite deliberately simple, because the rule is simple. Everybody else here is waaaaay overthinking this for some reason.
    – Lightness Races in Orbit
    Nov 16, 2019 at 22:38
  • @JJforTransparencyandMonica That definition says "colloquial". Legal terms of service do not use colloquial phrases. It's also intransitive and thus does not fit the usage. I am telling you, the ToS wording is crystal clear.
    – Lightness Races in Orbit
    Nov 17, 2019 at 1:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .