Editing 1998: GDPR

{{comic
| number    = 1998
| date      = May 25, 2018
| title     = GDPR
| image     = gdpr.png
| titletext = By clicking anywhere, scrolling, or closing this notification, you agree to be legally bound by the witch Sycorax within a cloven pine.
}}

==Explanation==
This comic was released on the date on which the {{w|General Data Protection Regulation|General Data Protection Regulation (GDPR)}} law went into effect. Most people will have already seen a large number of updated privacy policies in the week or two leading up to this law going active. And while [[xkcd]] would likely be outside of the jurisdiction that the law can enforce, it technically does fall within the scope of the law (as certainly EU citizens visit xkcd). This ''extra-territorial applicability'' is one of the major keys in this regulation and can be seen in more detail at the ''[https://www.eugdpr.org/key-changes.html EU GDPR Information Portal]''.

There are several references made to this law, but also several jokes are included about the way people treat privacy policies specifically, and user agreements in general.

The comic is a joke privacy policy, with terms that no one would agree to under normal circumstances. In most cases, website users will use websites without reading the policies, potentially "agreeing" to something unexpected.

{|class="wikitable"
!What Randall says !! Explanation
|-
!colspan="2"|Privacy policy
|-
|We've updated our privacy policy. This is purely out of the goodness of our hearts, and has nothing to do with any hypothetical unions on any particular continents.
|"purely out of the goodness of our hearts" is a phrase never expected to be found ever anywhere in any privacy policy.  "and has nothing to do with ..." is a blatantly transparent lie - if this were a real privacy policy. Randall likely makes fun of companies announcing changes to their privacy policy without mentioning the GDPR being the reason, which tries to create the impression that the companies just wanted to improve it without being forced to do so.
|-
|Please read every part of this policy carefully, and don't just skip ahead looking for sex scenes.
|It's not unheard of for people watching {{w|B movie|B-movies}} to try and skip ahead to sex scenes. This is also likely a reference to how most users don't read a website's privacy policy and skip to the bottom looking to the button to close it out.
|-
|This policy governs your interactions with this website, herein referred to as "The Service", "The Website", "The Internet", or "Facebook", and with all other websites and organizations of any kind.
|This starts out as a plausibly valid statement including "the service" and "the website".  But then balloons outward to include the entire Internet and Facebook.  As this presumably is a privacy policy only for xkcd, this policy should not attempt to claim that it also represents and governs Facebook or the entire Internet. The extension to Facebook may be a reference to reports that [https://www.smh.com.au/world/asia/facebook-is-the-internet-for-many-people-in-south-east-asia-20180322-p4z5nu.html "for many people ... Facebook is the Internet."]
|-
|The enumeration in this policy, of certain rights, shall not be construed to deny or disparage others retained by the users. By using this service, you opt in to quartering troops in your home.
|The language that the privacy policy will not "deny or disparage" any preexisting rights mirrors that of the {{w|Ninth Amendment to the United States Constitution}}, substituting "this policy" for "the Constitution" and "users" for "people." The agreement claims that it does not "deny or disparage" any of the user's other rights, but then immediately denies the user the right not to quarter troops in their home, which is a constitutional right described by the {{w|Third Amendment to the United States Constitution}}. Refusing to quarter troops in one's home was previously referenced in [[496: Secretary: Part 3]]. Note that the Third Amendment only applies to Americans. However, less specific written laws guaranteeing the privacy of one's home also exist in nearly all European countries.
|-
!colspan="2"|Your personal information
|-
|Please don't send us your personal information. We do not want your personal information. We have a hard enough time keeping track of our ''own'' personal information, let alone yours.
|"Please don't send us your personal information" is also a phrase never expected to be found ever in a privacy policy, though [https://www.improbableisland.com/privacy.php some come close].  A privacy policy, by default, is a contract users agree to BECAUSE personal information is being stored. This formulation [https://law.stackexchange.com/questions/44044/unsolicited-ideas-clause-in-terms-of-service-in-the-context-of-corporate-email-c "resembles the unsolicited ideas part of a terms of use contract"], where a company asks not to be sent suggestions or inspiration by its users and claims all IP rights on such unsolicited ideas. This can also be a reference to the previous comic [[1997: Business Update]] or perhaps [[1506: xkcloud]].
|-
|If you tell us your name, or any identifying information, we will forget it immediately. The next time we see you, we'll struggle to remember who you are, and try desperately to get through the conversation so we can go online and hopefully figure it out.
|[[1089: Internal Monologue|Long, awkward conversations]] and [[302: Names|forgetting people's names]] are both themes featured in previous XKCD comics.
|-
!colspan="2"|Tracking pixels, cookies, and beacons
|-
|This website places pixels on your screen in order to form text and images, some of which may remain in your memory after you close the page.
|"This website places pixels" is something websites are designed to do and has nothing to do with privacy policies. Websites are more often employing "{{w|Web_beacon|tracking pixels}}" from companies such as Facebook and Twitter, which is an image file that is hosted on an external server that allows cross-platform and cross-session tracking for targeted advertisements. This is a controversial topic, as many people are against this kind of usage tracking.
|-
|We use cookies to enhance your performance.
|Privacy policies normally deal with electronic cookies that track user activity and store personal information. This apparently says that Randall is giving out actual cookies that can be eaten. Depending on what "enhance your performance" means, these cookies may contain steroids, nootropics, or other compounds that alter the users' physiology. Depending on the particular compounds, their purpose, and the jurisdiction, this may be illegal. Another more innocuous possibility is that Randall is simply giving users a tasty treat as a reward, which may make users more motivated in their tasks, and therefore have their performance enhanced.
|-
|Our website may use local storage on your device if we run low on space on our end.
|"may use local storage" is threatening to turn the user's device into cloud storage should Randall run out of space on his drive.
|-
|We may use beacons to call Rohan for aid.
|Beacons in privacy policies usually refer to {{w|web beacons}}. This privacy policy refers to the [[wikia:lotr:Warning beacons of Gondor|Warning beacons of Gondor]], a system to call for aid used by {{w|Gondor}} in ''{{w|The Lord of the Rings}}''. They were used before the [[wikia:lotr:Siege of Gondor|Battle of the Pelennor Fields]] to request the aid of the Rohirrim, the inhabitants of {{w|Rohan (Middle-earth)|Rohan}}. The use of the Beacons has previously been mentioned in [[921: Delivery Notification]].
|-
!colspan="2"|3rd party extension
|-
|This service may utilize 3rd party extensions in order to play the song '''''Can U Feel It''''' from their debut album '''''Alive'''''.
|{{w|3rd Party}} was a three-member dance-pop group that released one album in 1997, "Alive". In software, "third-party extensions" are small programs that plug into a larger program to modify its behavior, and are created neither by the maker of the larger program nor the user.
|-
!colspan="2"|Permission
|-
|For users who are citizens of the European Union, we will now be requesting permission before initiating organ harvesting.
|This part can be construed in several frightening ways.  1. We will ask you after you die if you are willing to donate your organs.  2. We were not asking permission before, but now we have to ask.  3. We will ask you, but your answer doesn't actually matter.  4. We've switched from an organ donation program (legal) to an organ harvesting program (wildly illegal). 5. Anyone ''not'' in the EU will have (or, possibly, ''continue'' to have) their organs harvested without permission.  Besides these frightening scenarios, there is also the question of how a website (and not a doctor) is going to perform the harvesting.
|-
!colspan="2"|Scope and limitations
|-
|This policy supersedes any applicable federal, state, and local laws, regulations and ordinances, international treaties, and legal agreements that would otherwise apply.
|This is an apparently valid statement.  Its inclusiveness is quite extreme, but appears to be a technically valid statement. However, many laws and constitutional rights cannot be superseded by an ordinary privacy policy.
|-
|If any provision of this policy is found by a court to be unenforceable, it nevertheless remains in force.
|This part claims to have higher jurisdiction than any court and can somehow maintain legality even if a court disagrees.  A typical policy would read that an unenforceable provision would not invalidate the rest of the policy.
|-
|This organization is not liable and this agreement shall not be construed.
|"not liable" and "shall not be construed" are blanket statements that are supposed to have limiters.  For example, a restaurant could have a policy stating "not liable for burns received from our hot coffee."  A statement made to a court could say "The defendant's statement of giving the prostitute money shall not be construed as an admission of committing a crime." This makes little sense when claiming the website “is not liable” for anything, and “shall not be construed” to have any meaning whatsoever.
|-
|These statements have not been evaluated by the FDA. This website is intended to treat, cure  and prevent any disease.
|The {{w|Food and Drug Administration}} has nothing to do with privacy policies, but anything that promotes itself as being intended to prevent, cure or treat disease requires FDA approval. To circumvent the need for FDA approval (which requires very expensive statistically significant double blind clinical trials), the labels on unapproved herbal remedies state they are “not intended to prevent, cure or treat any disease.” In some cases, this statement appears to be false, although not as patently absurd as the claim that xkcd will treat, cure and prevent any disease, which, if taken literally and not as a joke, would require the site to be FDA approved.
|-
|If you know anyone in Europe, please tell them we're cool.
|Randall implies that the data protection regulation would have a major impact on European citizens while the U.S. isn't involved. Both aren't true, because many of the regulation already existed before in other national or European wide laws which the GDPR just states more precisely and all U.S. websites with an audience in Europe had to adopt their policies because they fall within the scope of the law. Nonetheless, most European citizens stayed cool as well. Cool may mean trendy, as in the website does not seem backwards and old-fashioned, okay/safe, as in the website is trying to ensure Europeans that it will not harvest their organs, or, knowing xkcd, physically cool, as in the website's headquarters sets the thermostat low.
|}

The title text is a reference to Shakespeare's "{{w|The Tempest}}", in which the witch {{w|Sycorax}} imprisoned the sprite Ariel in a cloven pine prior to Ariel's rescue by Prospero. As this clause cannot be escaped by anything short of restarting your computer, it may also reflect on how hard it often proves to be to opt out of privacy policy agreements and other forms to be filled on website, for all that they may appear optional. The fact that it appears as a title-text akin to a footnote, which a careless reader of the Privacy Policy may not notice at first glance, may also continue the joke of small but unexpected clauses hidden amidst a long-winded block of legalese, agreed to by users who haven't read them.

==Transcript==
:[The picture shows a long text:]
:'''Privacy policy'''
:We've updated our privacy policy. This is purely out of the goodness of our hearts, and has nothing to do with any hypothetical unions on any particular continents. Please read every part of this policy carefully, and don't just skip ahead looking for sex scenes.
:This policy governs your interactions with this website, herein referred to as "The Service", "The Website", "The Internet", or "Facebook", and with all other websites and organizations of any kind. The enumeration in this policy, of certain rights, shall not be construed to deny or disparage others retained by the users. By using this service, you opt in to quartering troops in your home.

:'''Your personal information'''
:Please don't send us your personal information. We do not want your personal information. We have a hard enough time keeping track of our ''own'' personal information, let alone yours.
:If you tell us your name, or any identifying information, we will forget it immediately. The next time we see you, we'll struggle to remember who you are, and try desperately to get through the conversation so we can go online and hopefully figure it out.

:'''Tracking pixels, cookies, and beacons'''
:This website places pixels on your screen in order to form text and images, some of which may remain in your memory after you close the page. We use cookies to enhance your performance. Our website may use local storage on your device if we run low on space on our end. We may use beacons to call Rohan for aid.

:'''3rd party extension'''
:This service may utilize 3rd party extensions in order to play the song '''''Can U Feel It''''' from their debut album '''''Alive'''''.

:'''Permission'''
:For users who are citizens of the European Union, we will now be requesting permission before initiating organ harvesting.

:'''Scope and limitations'''
:This policy supersedes any applicable federal, state, and local laws, regulations and ordinances, international treaties, and legal agreements that would otherwise apply. If any provision of this policy is found by a court to be unenforceable, it nevertheless remains in force.
:This organization is not liable and this agreement shall not be construed. These statements have not been evaluated by the FDA. This website is intended to treat, cure  and prevent any disease.
:If you know anyone in Europe, please tell them we're cool.

{{comic discussion}}

[[Category:LOTR]]