I can see that Stack Overflow does not participate in the Privacy Shield program since 2020/04/17. This was two months after the last update on privacy policies and three months before the EU–US Privacy Shield was declared invalid on 16 July 2020 because "it did not provide adequate protection to EU citizens on government snooping" (despite what the company has previously said).

How is the company going to follow EU laws to protect the rights of people in the EU?

Is Nicole Mason on the [email protected] email still valid for this type of questions?

  • 1
    I'm not in the EU - and so might be out of the loop but if its ruled invalid - what replaced it, and is seen as adequate? Also a big chunk of the "International Data Transfers" part of the privacy policy refers to this so it seems a little messy Commented May 7, 2021 at 13:05
  • 2
    @JourneymanGeek Not sure what it is going to replace it, I haven't heard anything on this lately. I was reminded of this when I heard that Microsoft has decided to not move data from EU clients outside EU data centers (I presume to avoid further changes as the law changes and the other possible complications).
    – llrs
    Commented May 7, 2021 at 13:18
  • 4
    Anyway, that's probably for Stack Overflow's legal team to deal with. I've retagged it, and I'll be curious to what the company's actions would be ;) Commented May 7, 2021 at 13:33
  • Commenting again to bump the question and see if there is any official response. (Was checking if there is an official way to remind this kind of issues but didn't find anything). Next step is sending an email.
    – llrs
    Commented Sep 20, 2021 at 14:41
  • 1
    @llrs please don't ask multiple questions in one question. Using edits in this manner to "bump" your question is frowned upon. Also comments don't "bump" a question either. For that your most accepted bet would be starting a bounty on it. Also as this is tagged with status-review it is/has been on the teams radar.
    – Luuklag
    Commented Sep 20, 2021 at 18:19

1 Answer 1


This is a great question, and unfortunately, it requires kind of a complex answer that comes down to the specifics of where a user resides, or works, and what the situation is. Like most other companies in the industry, we don’t publish our full compliance strategy around this, because some things are just better kept in your pocket until you need them. It’s also very important to remember that we have a global user-base, and as such, we are tasked to comply with more than just the GDPR.

First, it’s important to know that Privacy Shield itself was not something with which to comply: it was a certification that we were in compliance with the GDPR requirements. But broadly speaking, it’s correct that Privacy Shield (the certificate, not the GDPR) was invalidated. The fact that it was invalidated didn’t immediately change anything for us here: we continue to execute on the same practices and processes that allowed us to obtain Privacy Shield (which, again, only certified compliance with the GDPR), while we wait for governments and courts to work out whatever the next iteration is. However, Privacy Shield was only one avenue for compliance with EU laws. Depending on the situation, there are several other paths we take to remain in compliance, including through the use of Standard Contractual Clauses (SCCs), which are widely accepted as meeting requirements.

We also identified that our old policy was outdated and still mentioned the Privacy Shield framework, which we’ve corrected with the changes made today. Although I can’t go into the pieces in place for each of the legal eventualities, what I can do is assure you that Stack takes user privacy seriously. We have staff that is targeted at privacy generally (a data privacy attorney), and we have privacy baked into our design principles. We believe these things demonstrate the care and thoughtfulness that’s gone into crafting our policies and practices around privacy.

If you’d like to get directly in touch with our privacy protection officers, the [email protected] is still the right email address.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .