The “Not Affiliated” Checkbox and the GDPR  ## Metadata - Author: [[Richard Best]] - Full Title: The “Not Affiliated” Checkbox and the GDPR - Category: #articles - Document Note: --- tags: - #GDPR - #WordPress - #LegalCompliance Author: [Author's Name] Source: [WP & Legal Stuff Blog] Reference: [https://wpandlegalstuff.com/the-not-affiliated-checkbox-and-the-gdpr/] date created: 2024-10-17 15:30 --- # Title: The Not-Affiliated Checkbox and GDPR Compliance ## Table of Contents: - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#-notes) - [📖 References](#-references) - [🗣️ Paraphrase](#-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB (Diversity, Equity, Inclusion, and Belonging) Assessment](#-deib-diversity-equity-inclusion-and-belonging-assessment) - [✅ Logical Validity](#-logical-validity) - [🔍 SEO Evaluation](#-seo-evaluation) - [🎯 Conclusion](#-conclusion) ### References: - WP & Legal Stuff Blog, "The Not-Affiliated Checkbox and GDPR Compliance," [WP & Legal Stuff Blog](https://wpandlegalstuff.com/the-not-affiliated-checkbox-and-the-gdpr/) ## 📝 Summary: This blog post explains how a common practice among WordPress users—adding a "Not Affiliated" checkbox on forms—may violate GDPR regulations. The article delves into why this checkbox could lead to non-compliance and suggests best practices for avoiding legal issues while respecting user consent. ## 📖 Main Content: The blog discusses the legality and ethics of adding a "Not Affiliated" checkbox to forms as a way of disclaiming any affiliation with third parties. It highlights how this checkbox could violate GDPR's rules on explicit consent, misleading users into making uninformed choices, and stresses the need for transparency in data collection practices. ### 🗒️ Notes: - **GDPR Compliance Overview**: - GDPR requires explicit, informed consent for data collection. - Checkbox disclaimers can be confusing or misleading to users. - **Problems with "Not Affiliated" Checkbox**: - It may trick users into thinking they are granting consent when they are not. - Misleading checkbox wording could result in violations of GDPR, especially Articles 5 and 7. - **Best Practices for Compliance**: - Clear, unambiguous language when collecting consent. - Use opt-in checkboxes for explicit consent instead of misleading disclaimers. - **Risk of Non-Compliance**: - Non-compliance with GDPR could lead to penalties, fines, and damage to a company's reputation. ## 📖 References: - WP & Legal Stuff Blog, "The Not-Affiliated Checkbox and GDPR Compliance," [https://wpandlegalstuff.com/the-not-affiliated-checkbox-and-the-gdpr/] ## 🗣️ Paraphrase: 1. The post emphasizes that under GDPR, user consent must be clear and explicit. A "Not Affiliated" checkbox may give the false impression that users are agreeing to something, which could easily lead to a violation of GDPR's requirements for informed consent. 2. Instead of using confusing or ambiguous checkboxes, companies should focus on clear, straightforward communication about what data is being collected and for what purpose. This is critical to maintaining transparency and avoiding legal issues. ## 📰 Newsletter: In this week's issue, we're highlighting an important legal issue for WordPress developers: compliance with GDPR. Did you know that using a "Not Affiliated" checkbox on your forms might violate GDPR's explicit consent requirements? Check out our latest post on WP & Legal Stuff, which dives deep into why this common practice could land you in legal trouble, and learn the best practices for staying compliant. Read the full post [here](https://wpandlegalstuff.com/the-not-affiliated-checkbox-and-the-gdpr/). ## ✅ Action Items: This article directly ties into my advocacy for transparency in open-source projects. As a Developer Advocate at GoDaddy, I need to educate WordPress developers on how to properly collect user consent without violating GDPR regulations. I will incorporate this information into my WordPress training sessions and ensure developers understand the legal ramifications of improper data collection practices. ## 🧪 Hypotheses: 1. Adding a "Not Affiliated" checkbox increases the likelihood of GDPR violations due to unclear consent practices. 2. Developers who use explicit opt-in mechanisms will have higher user trust and lower risk of non-compliance penalties. ### 📊 Methodology: - Conduct a survey of WordPress developers to see how many currently use disclaimers like "Not Affiliated" checkboxes. - Analyze the impact of clear consent practices on GDPR compliance rates. ### ❓ Questions: - How often do WordPress developers use checkboxes like "Not Affiliated," and are they aware of the potential legal risks? - What steps can developers take to ensure their forms are GDPR-compliant without misleading users? ### 🔮 Future Research: Future research should focus on how developers can integrate GDPR-compliant practices into WordPress plugins that handle user consent, ensuring widespread adoption of transparent data collection methods. ### 💡 Implications: Ensuring GDPR compliance not only protects developers from legal action but also builds user trust. By adopting clearer consent practices, companies can safeguard their reputation and avoid costly penalties. ### 🧠 Learning Styles Assessment: 1. **Visual Learners (Spatial)**: - **Present**: The article lacks visuals but could benefit from flowcharts illustrating the decision-making process for GDPR compliance. - **Improve**: Add infographics that depict the differences between proper and improper consent forms. 2. **Aural Learners (Auditory-Musical)**: - **Present**: No auditory content is present. - **Improve**: Include an audio version or a podcast discussing the implications of GDPR compliance for developers. 3. **Verbal Learners (Linguistic)**: - **Present**: The content is rich with descriptions but could benefit from more concrete examples. - **Improve**: Use analogies and storytelling to explain why clear consent is crucial under GDPR. 4. **Physical Learners (Kinesthetic)**: - **Present**: The article does not offer any hands-on tasks. - **Improve**: Include an interactive demo or checklist that developers can use to test their forms for compliance. 5. **Logical Learners (Mathematical)**: - **Present**: The steps for GDPR compliance are logical but could use more structure. - **Improve**: Add flowcharts or decision trees to clarify the compliance process. 6. **Social Learners (Interpersonal)**: - **Present**: The article does not encourage community interaction. - **Improve**: Link to forums or discussion groups where developers can share their experiences with GDPR compliance. 7. **Solitary Learners (Intrapersonal)**: - **Present**: The post offers enough information for personal reflection. - **Improve**: Include journaling prompts or reflection questions to help developers think through their compliance strategies. 8. **Naturalistic Learners**: - **Present**: No environmental connections. - **Improve**: Relate data privacy to real-world analogies like protecting personal property to engage naturalistic learners. ### 📊 Accessibility Assessment: - **Screen Reader Compatibility**: The article's text is accessible, but alt-text for potential images is missing. - **Improve**: Add alt-text descriptions for any visuals or infographics. - **Keyboard Navigation**: The article is keyboard navigable, with no interactive elements hindering access. - **Improve**: No major changes needed. - **Contrast and Readability**: The font and contrast seem sufficient for readability. - **Improve**: Ensure color contrast meets WCAG guidelines for visually impaired users. - **Text Resizing**: The content is responsive, adjusting well to different text sizes. - **Improve**: None needed. ### 🌍 DEIB (Diversity, Equity, Inclusion, and Belonging) Assessment: - **Cultural Relevance**: The article does not include perspectives from diverse cultures. - Document Tags: [[lawsuit]] [[Matt Mullenweg]] [[wordpress]] [[wpdrama]] [[wp engine]] - Summary: TL;DR The punchline of this post is that the operator(s) of WordPress.org may, through the “I am not affiliated…” checkbox, be breaching Europe’s General Data Protection Regulation (GDPR), and that is something of which the board of Automattic ought to be aware. Let me explain. The “not affiliated” checkbox As is well known across the community, on or around 8 October, the login screen on WordPress.org was amended to look like this (originally it linked to the WP Engine lawsuit, but that was subsequently removed): Application of the GDPR First of all, there is a strong argument that the operator(s) of WordPress.org are subject to the GDPR in relation to their processing of EU residents’ personal data through WordPress.org. For example, there are localised versions of WordPress.org translated into the languages of some EU member states (e.g., de.wordpress.org/) and so services are being actively offered to EU residents, and the WordPress.org privacy statement appears to have been written on the assumption the GDPR applies. Personal data processing through the checkbox Under the GDPR, “personal data” … - URL: https://wpandlegalstuff.com/the-not-affiliated-checkbox-and-the-gdpr/ [](https://wpandlegalstuff.com/the-not-affiliated-checkbox-and-the-gdpr/) ##### TL;DR The punchline of this post is that the operator(s) of WordPress.org may, through the “I am not affiliated…” checkbox, be breaching Europe’s General Data Protection Regulation (GDPR), and that is something of which the board of Automattic ought to be aware. Let me explain. ##### The “not affiliated” checkbox As is well known across the community, on or around 8 October, the login screen on WordPress.org was amended to look like this (originally it linked to the WP Engine lawsuit, but that was subsequently removed):  ##### Application of the GDPR First of all, there is a strong argument that the operator(s) of WordPress.org are subject to the GDPR in relation to their processing of EU residents’ personal data through WordPress.org. For example, there are localised versions of WordPress.org translated into the languages of some EU member states (e.g., [de.wordpress.org/](https://de.wordpress.org/)) and so services are being actively offered to EU residents, and the WordPress.org privacy statement appears to have been written on the assumption the GDPR applies. ##### Personal data processing through the checkbox Under the GDPR, “personal data” is any information relating to an identified or identifiable natural person. Large numbers of WordPress.org users are identifiable through the usernames or email addresses they use to log in for developer access or to access the forums. Information as to whether such a person is not affiliated with WP Engine in any way, financially or otherwise, can be considered “personal data” about that person. Requiring EU residents to click the “I am not affiliated with WP Engine in any way” checkbox amounts to the processing of personal data about those residents (and the login with this checkbox is appearing in European member states — I’ve checked). MM was asked whether the checkbox value is stored and he said no, but others dispute that (e.g., “‘it’s not being stored’ is bullshi[\*], as logins get logged and a check is required for login, so it is being stored”). Regardless of whether the specific checkbox value is being stored, the fact remains that, from the date the mandatory checkbox was implemented, every single person whose login screen has that checkbox and who logs into WordPress.org having clicked the checkbox can be taken to have clicked the checkbox and so, in this way, personal data is being processed. Under Article 5(1) of the GDPR, personal data shall be “processed lawfully, fairly and in a transparent manner”, “collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes”, and “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed”. Under article 6, processing shall be lawful only if and to the extent that at least one of the grounds listed in article 6(1) applies. There are six grounds which can be summarised as: * consent * necessary for the performance of a contract * necessary for compliance with a legal obligation * necessary to protect the vital interests of the data subject or another natural person * necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller * necessary for the purposes of the legitimate interests pursued by the controller or by a third party. There is a strong argument that none of these grounds applies. One might argue that the ‘legitimate interests’ ground applies but, in my view, in all the circumstances surrounding the checkbox, any such argument would be weak and probably fail. I note, in this context, that the argument that WP Engine is attacking WordPress.org, that as a result WP Engine no longer has free access to WordPress.org’s resources, and that that justifies inclusion of the checkbox, is weak. So far as public attacks are concerned, the incontrovertible fact is that MM attacked WP Engine first, not the other way around. WP Engine’s cease and desist letter and, later following further attacks, its lawsuit, were in response to the attack upon it. In any case, and bearing in mind the ambiguity around the wording of the checkbox, there is no obvious reason why the operator(s) of WordPress.org needed to prevent *all* *people* with *any kind* of ‘affiliation’ with WP Engine from logging in, in order to prevent WP Engine *itself* from having free access to, or benefitting from *others’* free access to, WordPress.org’s resources. People might have some loose affiliation with WP Engine that *could not* have any bearing on the ability of WP Engine itself to access or benefit from others’ access to WordPress.org resources. Sure, as the owner/operator of the WordPress.org website, MM is able to deny WP Engine staff, contractors, and investors access to WordPress.org, but it does not follow from that that MM is able, in substance, to obtain an item of personal data (‘I am not affiliated with WP Engine’) from every single identifiable person who logs in to WordPress.org. Doing so is simply not necessary for the purposes of MM’s interests, *even if* they could be described as ‘legitimate’. ##### Breaches of the GDPR There is a strong argument, therefore, that — in relation to EU (and UK) residents — collecting/processing this item of personal data is contrary to the GDPR. (It may also be contrary to the privacy laws of some other jurisdictions.) It is also arguable that article 13 of the GDPR is being breached, because no information is provided at the point of collection as to “the purposes of the processing for which the personal data are intended as well as the legal basis for the processing” and other matters listed in article 13. The generic information in WordPress.org’s general [privacy policy](https://wordpress.org/about/privacy/) predates the checkbox, does not refer to it, and so does not clearly apply to it. It is noteworthy that the owner/controller of WordPress.org is also the CEO of Automattic which is a clear competitor to WP Engine and a named defendant in the lawsuit in relation to which the checkbox is said to be a response. One assumes members of Automattic’s board are aware of and willing to accept the GDPR-related risk (on the basis that, in substance, it is a controller or joint controller). If I was a board member, this is not a risk I would willingly accept, but obviously that’s not a call for me. ##### Not legal advice and no attack on WordPress.org Nothing in this post should be construed as legal advice. If any reader needs legal advice, they should consult a lawyer in their own jurisdiction. And to avoid doubt, I am not attacking WordPress.org or those who run it, regardless of what they may perceive. WordPress.org is awesome and for nearly two decades those behind it have been on a pedestal in my mind, revered for all they’ve achieved. But at some point, users’ privacy rights need to be respected, and enough has to be enough. Whilst one person may own and control the WordPress.org website, in substance it is the home for large parts of a global ecosystem. I suggest that foisting unreasonable requirements on members of that ecosystem, many of whom have helped make WordPress what it is today, needs to stop., The “Not Affiliated” Checkbox and the GDPR, Richard Best, 01jag9bqpejyrb25y9hc5p37v2.