3

TL;DR: What ISO 3166-2 region codes require GDPR compliance?

I'm trying to implement my own GDPR compliance using Google Tag Manager. This documentation has a header titled "Region-specific behavior." It says:

To set default consent states that apply to visitors from particular areas, specify a region in the template. Using region values enables template users to comply with regional regulations without losing information from visitors outside those regions. When a region is not specified in a setDefaultConsentState command, the value applies to all other regions.

For example, the following sets default status for analytics_storage to denied for visitors from Spain and Alaska, and sets analytics_storage to granted for all others:

const setDefaultConsentState = require('setDefaultConsentState');

setDefaultConsentState({
  'analytics_storage': 'denied',
  'region': ['ES', 'US-AK']
});
setDefaultConsentState({
  'analytics_storage': 'granted'
});

It provides zero information on where to find these region codes.

A clue is given in the API documentation. It says, "Region codes are expressed using country and/or subdivisions in ISO 3166-2 format." Just like the previous page, it doesn't provide a link to the list.

Thankfully, Wikipedia is one of the first results when you Google that format, and it does provide all the information.

Now you have every value you could use, but it's still up to you to reduce the list to GDPR codes. What region codes should be used for GDPR?

I know @TimSeguine 's comment to my question got a lot of upvotes, but according to the Law Stack Exchange, their statement is incorrect. Be that as it may, there is a good legal reason to always show the banner, just not for the reason given. If you're curious, check the link for more details.

Improve this question
6
  • 6
    The problem with solving GDPR compliance with country codes is, it is not in general sufficient to determine if a user is covered by the GDPR. The GDPR requires you to comply with certain practices for data pertaining to people who are citizens or residents of EU countries. it doesn't specify that you only have to comply if their computer or IP address reports an EU country code. I as a European permanent resident could be using a US computer terminal at an internet cafe at the moment to log in to an account. That doesn't automatically mean my data aren't protected by the GDPR.
    – Tim Seguine
    Sep 28, 2022 at 8:50
  • @TimSeguine I'm really surprised to hear this. The GDPR FAQ (is this official?) says it applies to "anyone in EU territory." Their What is GDPR page says it applies to organizations that "target or collect data related to people in the EU." Cookiebot charges extra to conditionally show their banner based off of location (maybe that's only for CCPA). Do you have an official source for your statement?
    – Daniel Kaplan
    Sep 28, 2022 at 20:52
  • I could be wrong about that. But even if I am, a EU resident could be using a VPN(and that is an increasingly likely circumstance). And in that case they are clearly and unambiguously still covered by it. They didn't sign away their rights because they made it slightly harder for you to notice they have them.
    – Tim Seguine
    Sep 29, 2022 at 15:30
  • 1
    For what it is worth, most of the guidance I have experience with was from the perspective of a multinational company that operates in the EU to such an extent that they effectively need to follow the GDPR more or less with all their data. So I am altogether not very surprised if what I said isn't exactly correct for everyone. My motivation with my comment was to try to steer you towards the conclusion that I made a long time ago that it is sensible to treat all users the same way as much as possible.
    – Tim Seguine
    Sep 30, 2022 at 10:30
  • 1
    @TimSeguine Absolutely, and I really appreciate you saying it because it spawned my other question and it's giving me tons of value.
    – Daniel Kaplan
    Sep 30, 2022 at 22:59

1 Answer 1

Reset to default
5

First, it's important to say I'm not a lawyer and this isn't legal advice.

I found a GDPR Country List that seems to be from 2022. This list does not include region codes, so I am crosschecking it with another list that associates EU countries with their region codes. I suppose I could've used Wikipedia to do this, but this link has a better signal-to-noise ratio and seems more official.

Country Region Code
Austria AT
Belgium BE
Bulgaria BG
Croatia HR
Republic of Cyprus CY
Czech Republic CZ
Denmark DK
Estonia EE
Finland FI
France FR
Germany DE
Greece EL
Hungary HU
Ireland IE
Italy IT
Latvia LV
Lithuania LT
Luxembourg LU
Malta MT
Netherlands NL
Poland PL
Portugal PT
Romania RO
Slovakia SK
Slovenia SI
Spain ES
Sweden SE
United Kingdom UK

Or, for those that just want the list of codes, it's AT, BE, BG, HR, CY, CZ, DK, EE, FI, FR, DE, EL, HU, IE, IT, LV, LT, LU, MT, NL, PL, PT, RO, SK, SI, ES, SE, UK.

I didn't end up using this github gist I found, but it provides a lot of historical information so I thought I'd bring it up.

Improve this answer
8
  • 5
    This list is missing a few countries as GDPR also applies in the so called EEA countries, Norway (NO), Iceland (IS) and Lichtenstein (LI)
    – MortenSickel
    Sep 28, 2022 at 7:04
  • 2
    GDPR will (presumably) apply to any countries that join the EU in the future. And may potentially stop applying to the UK.
    – MikeB
    Sep 28, 2022 at 7:19
  • @MortenSickel Okay so it sounds like my "a GDPR Country List" source is incomplete/wrong? Where did you find this information?
    – Daniel Kaplan
    Sep 28, 2022 at 8:37
  • 2
    @MikeBrockington: Technically speaking, the GDPR stopped applying to the UK the second they left the EU. They have, however, enacted a law that implements identical protections, wo even though the GDPR no longer applies, you still have to comply with the exact same rules. And of course, there may be other laws as well that provide similar protections, I believe California has one, for example.
    – Jörg W Mittag
    Sep 28, 2022 at 9:53
  • 1
    I happen to live in Norway and was pretty sure GDPR applies to us as well, and indeed it does due to EEA. The EEA countries have a close cooperation agreement with the EU so a lot of EU laws applies to us even though we are not members. As far as I know, there are no other countries with that kind of relationship to the EU, so unless someone outside EU/EEA have made similar rules, the list should be complete by adding NO, IS, LI.
    – MortenSickel
    Sep 28, 2022 at 10:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.