1998: GDPR - Revision history

The Wilbo: "xkcd" follows xkcd's style guidlines better than "XKCD".

2026-02-11T01:16:17Z

"xkcd" follows xkcd's style guidlines better than "XKCD".

FaviFake: /* Explanation */

2025-07-26T15:39:15Z

‎Explanation

FaviFake: table → list

2025-07-26T15:37:42Z

table → list

FaviFake: /* Explanation */

2025-07-26T15:37:27Z

‎Explanation

Show changes

162.158.167.69: /* Explanation */

2025-02-15T05:46:00Z

‎Explanation

172.70.162.161: /* Explanation */

2025-02-11T12:46:09Z

‎Explanation

172.71.178.58: /* Explanation */

2025-02-11T12:40:00Z

‎Explanation

172.69.194.35: /* Explanation */

2025-02-11T10:53:47Z

‎Explanation

172.70.34.148: Grammar

2025-02-11T06:12:58Z

Grammar

42.book.addict at 18:27, 24 October 2024

2024-10-24T18:27:48Z

@@ Line 34: / Line 34: @@
 ; If you tell us your name, or any identifying information, we will forget it immediately. The next time we see you, we'll struggle to remember who you are, and try desperately to get through the conversation so we can go online and hopefully figure it out.
-: [[1089: Internal Monologue|Long, awkward conversations]] and [[302: Names|forgetting people's names]] are both themes featured in previous XKCD comics.
+: [[1089: Internal Monologue|Long, awkward conversations]] and [[302: Names|forgetting people's names]] are both themes featured in previous xkcd comics.
 : As well as building upon the last paragraph's basic trouble with "keeping track of our ''own'' personal information", it is the antithesis of the usual assurance that a provider 'only' retains such necessary information (or stores cookies at your end) that it claims is to help you out the next time you return. In this case, it is so bad at it that it can't (even if it would actually be useful) and, like someone at a physical venue who cannot remember names and faces, may have to greet you with general and non-specific responses while desperately trying to establish what context they should know you by.

@@ Line 8: / Line 8: @@
 {{TOC}}
 ==Explanation==
-This comic was released on the date on which the {{w|General Data Protection Regulation|General Data Protection Regulation (GDPR)}} law went into effect. Most people will have already seen a large number of updated privacy policies in the week or two leading up to this law going active. And while [[xkcd]] would likely be outside of the jurisdiction that the law can enforce, it technically does fall within the scope of the law (as certainly EU citizens visit xkcd). This ''extra-territorial applicability'' is one of the major keys in this regulation and can be seen in more detail at the ''[https://www.eugdpr.org/key-changes.html EU GDPR Information Portal]''.
+This comic was released on the date on which the {{w|General Data Protection Regulation|General Data Protection Regulation (GDPR)}} law went into effect. The comic is a joke Privacy Policy, with terms that no one would agree to under normal circumstances. In most cases, website users will use websites without reading the policies, potentially "agreeing" to something unexpected. Most people had likely already been notified of a large number of updates to Privacy Policies in the weeks leading up to this law going in effect. While [[xkcd]] would likely be outside of the jurisdiction that the law can enforce, it technically does fall within the scope of the law (as certainly EU citizens visit xkcd). This ''extra-territorial applicability'' is one of the major keys in this regulation and can be seen in more detail at the ''[https://www.eugdpr.org/key-changes.html EU GDPR Information Portal]''.
 There are several references made to this law, but also several jokes are included about the way people treat privacy policies specifically, and user agreements in general.
 ===Privacy Policy===

@@ Line 6: / Line 6: @@
 | titletext = By clicking anywhere, scrolling, or closing this notification, you agree to be legally bound by the witch Sycorax within a cloven pine.
 }}
+{{TOC}}
 ==Explanation==
-{{TOC}}This comic was released on the date on which the {{w|General Data Protection Regulation|General Data Protection Regulation (GDPR)}} law went into effect. Most people will have already seen a large number of updated privacy policies in the week or two leading up to this law going active. And while [[xkcd]] would likely be outside of the jurisdiction that the law can enforce, it technically does fall within the scope of the law (as certainly EU citizens visit xkcd). This ''extra-territorial applicability'' is one of the major keys in this regulation and can be seen in more detail at the ''[https://www.eugdpr.org/key-changes.html EU GDPR Information Portal]''.
+This comic was released on the date on which the {{w|General Data Protection Regulation|General Data Protection Regulation (GDPR)}} law went into effect. Most people will have already seen a large number of updated privacy policies in the week or two leading up to this law going active. And while [[xkcd]] would likely be outside of the jurisdiction that the law can enforce, it technically does fall within the scope of the law (as certainly EU citizens visit xkcd). This ''extra-territorial applicability'' is one of the major keys in this regulation and can be seen in more detail at the ''[https://www.eugdpr.org/key-changes.html EU GDPR Information Portal]''.
 There are several references made to this law, but also several jokes are included about the way people treat privacy policies specifically, and user agreements in general.

@@ Line 34: / Line 34: @@
 |-
 |Please don't send us your personal information. We do not want your personal information. We have a hard enough time keeping track of our ''own'' personal information, let alone yours.
-|"Please don't send us your personal information" is also a phrase never expected to be found ever in a privacy policy, though [https://www.improbableisland.com/privacy.php some come close].  A privacy policy, by default, is a contract users agree to BECAUSE personal information is being stored. This formulation [https://law.stackexchange.com/questions/44044/unsolicited-ideas-clause-in-terms-of-service-in-the-context-of-corporate-email-c "resembles the unsolicited ideas part of a terms of use contract"], where a company asks not to be sent suggestions or inspiration by its users and claims all IP rights on such unsolicited ideas. This can also be a reference to the previous comic [[1997: Business Update]] or perhaps [[1506: xkcloud]].
+|"Please don't send us your personal information" is also a phrase never expected to be found ever in a privacy policy, though [https://www.improbableisland.com/privacy.php some come close].  A privacy policy, by default, is a contract users agree to BECAUSE personal information is being stored. This formulation [https://law.stackexchange.com/questions/44044/unsolicited-ideas-clause-in-terms-of-service-in-the-context-of-corporate-email-c "resembles the unsolicited ideas part of a terms of use contract"], where a company asks not to be sent suggestions or inspiration by its users and claims all IP rights on such unsolicited ideas. This section may be linked to Beret Guy's business from the previous comic, [[1997: Business Update]], and may also be a call back to [[1506: xkcloud]].
 It also, in a seemingly unguarded moment, reveals that there may be problems with data security on the site. This may well be an issue commonly experienced by online systems (internal 'private' data being leaked, and/or being lost/altered, either at random or through malicious interference), but not usually so readily admitted to in advance.
 |-

← Older revision		Revision as of 12:46, 11 February 2025
Line 87:		Line 87:

	The title text is a reference to Shakespeare's "{{w\|The Tempest}}", in which the witch {{w\|Sycorax}} imprisoned the sprite Ariel in a cloven pine prior to Ariel's rescue by Prospero. As this clause cannot be escaped by anything short of restarting your computer, it may also reflect on how hard it often proves to be to opt out of privacy policy agreements and other forms to be filled on website, for all that they may appear optional. The fact that it appears as a title-text akin to a footnote, which a careless reader of the Privacy Policy may not notice at first glance, may also continue the joke of small but unexpected clauses hidden amidst a long-winded block of legalese, agreed to by users who haven't read them.		The title text is a reference to Shakespeare's "{{w\|The Tempest}}", in which the witch {{w\|Sycorax}} imprisoned the sprite Ariel in a cloven pine prior to Ariel's rescue by Prospero. As this clause cannot be escaped by anything short of restarting your computer, it may also reflect on how hard it often proves to be to opt out of privacy policy agreements and other forms to be filled on website, for all that they may appear optional. The fact that it appears as a title-text akin to a footnote, which a careless reader of the Privacy Policy may not notice at first glance, may also continue the joke of small but unexpected clauses hidden amidst a long-winded block of legalese, agreed to by users who haven't read them.
		+
		+	A [[501: Faust 2.0\|prior contractual agreement]] involved such a diabolical agreement being twisted in the opposite direction.

	==Transcript==		==Transcript==

@@ Line 35: / Line 35: @@
 |Please don't send us your personal information. We do not want your personal information. We have a hard enough time keeping track of our ''own'' personal information, let alone yours.
 |"Please don't send us your personal information" is also a phrase never expected to be found ever in a privacy policy, though [https://www.improbableisland.com/privacy.php some come close].  A privacy policy, by default, is a contract users agree to BECAUSE personal information is being stored. This formulation [https://law.stackexchange.com/questions/44044/unsolicited-ideas-clause-in-terms-of-service-in-the-context-of-corporate-email-c "resembles the unsolicited ideas part of a terms of use contract"], where a company asks not to be sent suggestions or inspiration by its users and claims all IP rights on such unsolicited ideas. This can also be a reference to the previous comic [[1997: Business Update]] or perhaps [[1506: xkcloud]].
 |-
 |If you tell us your name, or any identifying information, we will forget it immediately. The next time we see you, we'll struggle to remember who you are, and try desperately to get through the conversation so we can go online and hopefully figure it out.
 |[[1089: Internal Monologue|Long, awkward conversations]] and [[302: Names|forgetting people's names]] are both themes featured in previous XKCD comics.
 |-
 !colspan="2"|Tracking pixels, cookies, and beacons
@@ Line 43: / Line 45: @@
 |This website places pixels on your screen in order to form text and images, some of which may remain in your memory after you close the page.
 |"This website places pixels" is something websites are designed to do and has nothing to do with privacy policies. Websites are more often employing "{{w|Web_beacon|tracking pixels}}" from companies such as Facebook and Twitter, which is an image file that is hosted on an external server that allows cross-platform and cross-session tracking for targeted advertisements. This is a controversial topic, as many people are against this kind of usage tracking.
 |-
 |We use cookies to enhance your performance.
-|Privacy policies normally deal with electronic cookies that track user activity and store personal information. This apparently says that Randall is giving out actual cookies that can be eaten. Depending on what "enhance your performance" means, these cookies may contain steroids, nootropics, or other compounds that alter the users' physiology. Depending on the particular compounds, their purpose, and the jurisdiction, this may be illegal. Another more innocuous possibility is that Randall is simply giving users a tasty treat as a reward, which may make users more motivated in their tasks, and therefore have their performance enhanced.
+|Privacy policies normally deal with electronic cookies that track user activity and store personal information. This apparently says that Randall is giving out actual cookies that can be eaten. Depending on what "enhance your performance" means, these cookies may contain steroids, nootropics, or other compounds that alter the users' physiology. "Enhance your performance" is particularly the kind of promise seen in advertisements (especially unsolicited spams) for drugs intended to offset erectile disfunction. Depending on the particular compounds, their purpose, and the jurisdiction, this may be illegal. Another more innocuous possibility is that Randall is simply giving users a tasty treat as a reward, which may make users more motivated in their tasks, and therefore have their performance enhanced.
 |-
 |Our website may use local storage on your device if we run low on space on our end.
 |"may use local storage" is threatening to turn the user's device into cloud storage should Randall run out of space on his drive.
 |-
 |We may use beacons to call Rohan for aid.
@@ Line 57: / Line 61: @@
 |This service may utilize 3rd party extensions in order to play the song '''''Can U Feel It''''' from their debut album '''''Alive'''''.
 |{{w|3rd Party}} was a three-member dance-pop group that released one album in 1997, "Alive". In software, "third-party extensions" are small programs that plug into a larger program to modify its behavior, and are created neither by the maker of the larger program nor the user.
 |-
 !colspan="2"|Permission
@@ Line 66: / Line 71: @@
 |-
 |This policy supersedes any applicable federal, state, and local laws, regulations and ordinances, international treaties, and legal agreements that would otherwise apply.
-|This is an apparently valid statement.  Its inclusiveness is quite extreme, but appears to be a technically valid statement. However, many laws and constitutional rights cannot be superseded by an ordinary privacy policy.
+|This is an apparently valid statement.  Its inclusiveness is quite extreme, but appears to be a technically valid statement. However, many laws and constitutional rights cannot be superseded by an ordinary privacy policy and contractual statements more often are required to acknowledgs that existing/future legal limitations may ''override'' some conditions stated within the contract.
 |-
 |If any provision of this policy is found by a court to be unenforceable, it nevertheless remains in force.
-|This part claims to have higher jurisdiction than any court and can somehow maintain legality even if a court disagrees.  A typical policy would read that an unenforceable provision would not invalidate the rest of the policy.
+|This part claims to have higher jurisdiction than any court and can somehow maintain legality even if a court disagrees. A typical policy would read that an unenforceable provision would not invalidate the rest of the policy.
 |-
 |This organization is not liable and this agreement shall not be construed.
 |"not liable" and "shall not be construed" are blanket statements that are supposed to have limiters.  For example, a restaurant could have a policy stating "not liable for burns received from our hot coffee."  A statement made to a court could say "The defendant's statement of giving the prostitute money shall not be construed as an admission of committing a crime." This makes little sense when claiming the website “is not liable” for anything, and “shall not be construed” to have any meaning whatsoever.
 |-
-|These statements have not been evaluated by the FDA. This website is intended to treat, cure  and prevent any disease.
+|These statements have not been evaluated by the FDA. This website is intended to treat, cure and prevent any disease.
-|The {{w|Food and Drug Administration}} has nothing to do with privacy policies, but anything that promotes itself as being intended to prevent, cure or treat disease requires FDA approval. To circumvent the need for FDA approval (which requires very expensive statistically significant double blind clinical trials), the labels on unapproved herbal remedies state they are “not intended to prevent, cure or treat any disease.” In some cases, this statement appears to be false, although not as patently absurd as the claim that xkcd will treat, cure and prevent any disease, which, if taken literally and not as a joke, would require the site to be FDA approved.
+|The {{w|Food and Drug Administration}} has nothing to do with privacy policies, but anything that promotes itself as being intended to prevent, cure or treat disease requires FDA approval. To circumvent the need for FDA approval (which requires very expensive statistically significant double blind clinical trials), the labels on unapproved herbal remedies state they are “not intended to prevent, cure or treat any disease.” In some cases, this statement appears to be false, especially in conjunction with (less legally interpretable) ''implications'' that this is the main purpose of the product, although not as patently absurd as the claim that xkcd will treat, cure and prevent any disease, which, if taken literally and not as a joke, would require the site to be FDA approved.
 |-
 |If you know anyone in Europe, please tell them we're cool.

@@ Line 26: / Line 26: @@
 |-
 |This policy governs your interactions with this website, herein referred to as "The Service", "The Website", "The Internet", or "Facebook", and with all other websites and organizations of any kind.
-|This starts out as a plausibly valid statement including "the service" and "the website".  But then balloons outward to include the entire Internet and Facebook.  As this presumably is a privacy policy only for xkcd, this policy should not attempt to claim that it also represents and governs Facebook or the entire Internet. The extension to Facebook may be a reference to reports that [https://www.smh.com.au/world/asia/facebook-is-the-internet-for-many-people-in-south-east-asia-20180322-p4z5nu.html "for many people ... Facebook is the Internet."]
+|This starts out as a plausibly valid statement including "the service" and "the website".  But then balloons outward to include the entire Internet and Facebook.  As this presumably is a privacy policy only for xkcd, this policy should not attempt to claim that it also represents and governs Facebook or the entire Internet. The extension to Facebook may be a reference to reports that [https://www.smh.com.au/world/asia/facebook-is-the-internet-for-many-people-in-south-east-asia-20180322-p4z5nu.html "for many people ... Facebook is the Internet."] This continues the long-held prior misunderstanding that "The Internet" is the same as "The Web" (or vice-versa), which is even less true now with the ubiquity of internet-connected apps that provide a bespoke portal on any given platform's contents without even browsing the actual web-facing "front end".
 |-
 |The enumeration in this policy, of certain rights, shall not be construed to deny or disparage others retained by the users. By using this service, you opt in to quartering troops in your home.

@@ Line 23: / Line 23: @@
 |-
 |Please read every part of this policy carefully, and don't just skip ahead looking for sex scenes.
-|It's not unheard of for people watching {{w|B movie|B-movies}} to try and skip ahead to sex scenes. This is also likely a reference to how most users don't read a website's privacy policy and skip to the bottom looking to the button to close it out.
+|It's not unheard of for people watching {{w|B movie|B-movies}} to try to skip ahead to sex scenes. This is also likely a reference to how most users don't read a website's privacy policy and skip to the bottom looking to the button to close it.
 |-
 |This policy governs your interactions with this website, herein referred to as "The Service", "The Website", "The Internet", or "Facebook", and with all other websites and organizations of any kind.

@@ Line 61: / Line 61: @@
 |-
 |For users who are citizens of the European Union, we will now be requesting permission before initiating organ harvesting.
-|This part can be construed in several frightening ways.  1. We will ask you after you die if you are willing to donate your organs.  2. We were not asking permission before, but now we have to ask.  3. We will ask you, but your answer doesn't actually matter.  4. We've switched from an organ donation program (legal) to an organ harvesting program (wildly illegal{{Citation needed}}). 5. Anyone ''not'' in the EU will have (or, possibly, ''continue'' to have) their organs harvested without permission.  Besides these frightening scenarios, there is also the question of how a website (and not a doctor) is going to perform the harvesting.
+|This part can be construed in several frightening ways.  1. We will ask you after you die if you are willing to donate your organs.  2. We were not asking permission before, but now we have to ask.  3. We will ask you, but your answer doesn't actually matter.  4. We've switched from an organ donation program (legal) to an organ harvesting program (wildly illegal).{{Citation needed}} 5. Anyone ''not'' in the EU will have (or, possibly, ''continue'' to have) their organs harvested without permission.  Besides these frightening scenarios, there is also the question of how a website (and not a doctor) is going to perform the harvesting.
 |-
 !colspan="2"|Scope and limitations