# How to make users to explicitly agree to ToS
**URL:** https://meta.discourse.org/t/how-to-make-users-to-explicitly-agree-to-tos/83480
**Category:** Support
**Tags:** gdpr
**Created:** [21.Март.2018 14:14:35 UTC](https://meta.discourse.org/t/how-to-make-users-to-explicitly-agree-to-tos/83480 "2018-03-21T14:14:35Z")
**Posts on this page:** 20
**Page:** 2
### Author:  [@tophee](https://meta.discourse.org/u/tophee)
#### Post date: [22.Март.2018 09:36:35 UTC](https://meta.discourse.org/t/how-to-make-users-to-explicitly-agree-to-tos/83480/21 "2018-03-22T09:36:35Z")
> [@sam](#):
>
> whether you can prove it
>
> Waiting for GDPR interpretation where you need call a GDPR officer to your house who signs off on your “for real” consent complete with a digital footage.
It’s not an interpretation. It’s what it says in GDPR Art. 7.1 (Conditions for consent):
> 1. Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [22.Март.2018 09:42:16 UTC](https://meta.discourse.org/t/how-to-make-users-to-explicitly-agree-to-tos/83480/22 "2018-03-22T09:42:16Z")
> [@tophee](#):
>
> It’s not an interpretation. It’s what it says in GDPR Art. 7.1 (Conditions for consent):
> [@sam](#):
>
> ranging from tinfoil hat insane madness
Just sayin’ 🤣
Honestly, some people go pretty nuts here, and anonymise IP addresses … everywhere … cause reasons … and then can no longer mitigate denial of service attacks.
My personal (NOT DISCOURSE) interpretation of GDPR basically boils down to don’t be a slimeball and collect and resell data (or track users across multiple properties) don’t have lax internal security practices and so on.
---
### Author:  [@Krzysztof\_Daniel](https://meta.discourse.org/u/Krzysztof_Daniel)
#### Post date: [22.Март.2018 09:49:26 UTC](https://meta.discourse.org/t/how-to-make-users-to-explicitly-agree-to-tos/83480/23 "2018-03-22T09:49:26Z")
> [@sam](#):
>
> My personal (NOT DISCOURSE) interpretation of GDPR basically boils down to don’t be a slimeball and collect and resell data (or track users across multiple properties) don’t have lax internal security practices and so on.
IMHO, this will keep you away from most of the accidental problems. However, lack of compliance may attract wrong kind of people - and then you have to show them that somebody claiming to be owning their email address clicked said checkbox on that day. That shields you in the best possible way.
VPNs and other stuff does not really matter here - if the user claims it was not him, you did your job, remove him from the database and you are done. You could not do anything more, or doing anything more was not reasonable.
But you need to get basics right.
---
### Author:  [@tophee](https://meta.discourse.org/u/tophee)
#### Post date: [22.Март.2018 09:50:05 UTC](https://meta.discourse.org/t/how-to-make-users-to-explicitly-agree-to-tos/83480/24 "2018-03-22T09:50:05Z")
> [@sam](#):
>
> My personal (NOT DISCOURSE) interpretation of GDPR basically boils down to don’t be a slimeball and collect and resell data (or track users across multiple properties) don’t have lax internal security practices and so on.
I don’t dare to make predictions, but that’s what I’d hope too.
However, there are two sides to this: one is official law enforcement. Another, however, is internal compliance procedures, especially in public administrations (perhaps most relevant here: universities, but also, say, city administrations, for example): in my experience, these organizations will be annoyingly cautious in making sure they don’t do anything wrong because nobody wants to be the one responsible in case something goes wrong. In this internal compliance process especially, where it would help tremendously to be able to point decision-makers to some site setting called “enforce active consent to data processing” or something like that.
In a way, there is a chance for discourse establishing “common practice” and thereby influence how the law is interpreted.
> [@Krzysztof\_Daniel](#):
>
> remove him from the database and you are done.
I don’t think it’s a simple as that. On dicourse you can’t simply remove a user from the database…
---
### Author:  [@Krzysztof\_Daniel](https://meta.discourse.org/u/Krzysztof_Daniel)
#### Post date: [22.Март.2018 10:10:22 UTC](https://meta.discourse.org/t/how-to-make-users-to-explicitly-agree-to-tos/83480/25 "2018-03-22T10:10:22Z")
> [@tophee](#):
>
> On dicourse you can’t simply remove a user from the database…
The minimum I’d expect from discourse is admins being able to at least anonymise an account (break the connection between user and his data).
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [22.Март.2018 17:26:13 UTC](https://meta.discourse.org/t/how-to-make-users-to-explicitly-agree-to-tos/83480/26 "2018-03-22T17:26:13Z")
> [@tophee](#):
>
> Having someone’s email surely doesn’t prove anything
What I meant to say is that in such a case the consent process is unrelated to Discourse.
> [@ChrisBeach](#):
>
> With GDPR, on the other hand, the minimum fine for non-compliance is €2M
That is incorrect. There are no minimum fines.
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [22.Март.2018 17:32:36 UTC](https://meta.discourse.org/t/how-to-make-users-to-explicitly-agree-to-tos/83480/27 "2018-03-22T17:32:36Z")
> [@sam](#):
>
> If you look at complaints vs fines odds of actually being fined are enormously low and I doubt this will change though I am no lawyer.
I expect the contrary. Because the cookie law was never really enforced, people never took it seriously. You can see that when this law was made, the lessons learned with the cookie law have clearly been applied. My personal prediction is that in Q3 2018 the authorities will set a few examples by imposing a huge fine and a lot of publicity upon some pretty well-known companies.
---
### Author:  [@awlogan](https://meta.discourse.org/u/awlogan)
#### Post date: [22.Март.2018 19:27:30 UTC](https://meta.discourse.org/t/how-to-make-users-to-explicitly-agree-to-tos/83480/28 "2018-03-22T19:27:30Z")
There are in fact minimums, it’s a set amount or a percentage, whichever is higher. Meaning the set amount is the minimum. See [Article 83 EU General Data Protection Regulation (EU-GDPR). Privacy/Privazy according to plan.](https://www.privacy-regulation.eu/en/83.htm)
**4.** Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 10,000,000 EUR, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher:
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [22.Март.2018 19:29:42 UTC](https://meta.discourse.org/t/how-to-make-users-to-explicitly-agree-to-tos/83480/29 "2018-03-22T19:29:42Z")
> [@awlogan](#):
>
> There are in fact minimums, it’s a set amount or a percentage, whichever is higher.
No, those are maximums. The text says ‘up to’. Twice.
---
### Author:  [@tophee](https://meta.discourse.org/u/tophee)
#### Post date: [22.Март.2018 19:36:37 UTC](https://meta.discourse.org/t/how-to-make-users-to-explicitly-agree-to-tos/83480/30 "2018-03-22T19:36:37Z")
> [@RGJ](#):
>
> The text says ‘up to
Yeah, corporate lobbying seems to have worked… ☹
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [22.Март.2018 19:38:38 UTC](https://meta.discourse.org/t/how-to-make-users-to-explicitly-agree-to-tos/83480/31 "2018-03-22T19:38:38Z")
> [@tophee](#):
>
> Yeah, corporate lobbying seems to have worked…
Well, it wouldn’t be really fair if a small two person company that made a honest mistake would be fined 10 million, would it?
---
### Author:  [@tophee](https://meta.discourse.org/u/tophee)
#### Post date: [22.Март.2018 19:41:35 UTC](https://meta.discourse.org/t/how-to-make-users-to-explicitly-agree-to-tos/83480/32 "2018-03-22T19:41:35Z")
Of course not. I didn’t mean to imply that it should have been “at least”. Not at all. But the only ones who benefit from the “up to” wording, especially “up to 2 percent”, are the big corporations (because it’s “whichever is higher”).
---
### Author:  [@awlogan](https://meta.discourse.org/u/awlogan)
#### Post date: [22.Март.2018 19:44:06 UTC](https://meta.discourse.org/t/how-to-make-users-to-explicitly-agree-to-tos/83480/33 "2018-03-22T19:44:06Z")
> [@awlogan](#):
>
> whichever is higher
and ends with that…
---
### Author:  [@tophee](https://meta.discourse.org/u/tophee)
#### Post date: [22.Март.2018 19:45:26 UTC](https://meta.discourse.org/t/how-to-make-users-to-explicitly-agree-to-tos/83480/34 "2018-03-22T19:45:26Z")
That just means that the _maximum_ fine is either 10m or 2 percent, whichever is higher.
---
### Author:  [@awlogan](https://meta.discourse.org/u/awlogan)
#### Post date: [22.Март.2018 19:46:48 UTC](https://meta.discourse.org/t/how-to-make-users-to-explicitly-agree-to-tos/83480/35 "2018-03-22T19:46:48Z")
Guess we’ll see, I’m going off my consultants and lawyers recommendations who expect them to push hard on fines, especially with the Facebook debacle of the week.
---
### Author:  [@ChrisBeach](https://meta.discourse.org/u/ChrisBeach)
#### Post date: [22.Март.2018 23:49:43 UTC](https://meta.discourse.org/t/how-to-make-users-to-explicitly-agree-to-tos/83480/36 "2018-03-22T23:49:43Z")
> [@RGJ](#):
>
> That is incorrect. There are no minimum fines.
Apologies, I was wrong, or out of date, with the €2M minimum fine. The actual minimum fine is €10M:
> **[Business strategy, analytics, and case studies: management, sales, brands,...](https://gdpr.associates/)**
>
> Publications on project development: market breakdowns, communication approaches, demand and competitor analysis, tools for research and planning. Trend updates and solution examples
> [@](#):
>
> There will be two levels of fines based on the GDPR. The first is up to €10 million or 2% of the company’s global annual turnover of the previous financial year, **whichever is higher**. The second is up to €20 million or 4% of the company’s global annual turnover of the previous financial year, whichever is higher.
---
### Author:  [@Mittineague](https://meta.discourse.org/u/Mittineague)
#### Post date: [23.Март.2018 01:24:41 UTC](https://meta.discourse.org/t/how-to-make-users-to-explicitly-agree-to-tos/83480/37 "2018-03-23T01:24:41Z")
Errm, isn’t that more correctly the “minimum maximum amount”? 😉
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [23.Март.2018 07:06:26 UTC](https://meta.discourse.org/t/how-to-make-users-to-explicitly-agree-to-tos/83480/38 "2018-03-23T07:06:26Z")
> [@ChrisBeach](#):
>
> The actual minimum fine is €10M:
There is no minimum fine. You’re putting the emphasis wrong. Let me try to explain it again, by splitting the sentence.
The first is **up to** X
Where X = €10 million or 2% of the company’s global annual turnover of the previous financial year, whichever is higher
---
### Author:  [@McBlu](https://meta.discourse.org/u/McBlu)
#### Post date: [23.Март.2018 17:28:18 UTC](https://meta.discourse.org/t/how-to-make-users-to-explicitly-agree-to-tos/83480/39 "2018-03-23T17:28:18Z")
If anyone was inspired by this topic like I was to add a user field at sign up for people to check that they’ve reviewed the TOS or FAQs or whatever it is they require, here is the very simple way to achieve that:
> [@(Retired) Use an ID in a custom user field to link to a user's external profile](https://meta.discourse.org/t/link-custom-user-field-to-external-website/41218/44):
>
> For anyone who is not a coder wanting to link words in a customized user field to a webpage, here is how you do it. I wanted to add this customized field at sign up, so I filled in the form like so: With this code in the field description (thanks to @dax) for the linked words: I am cool with the guidelines \found here\ This is the custom field new members see. They click on “found here” to review our groundrules, which are stri…
---
### Author:  [@dnsmichi](https://meta.discourse.org/u/dnsmichi)
#### Post date: [23.Март.2018 19:24:16 UTC](https://meta.discourse.org/t/how-to-make-users-to-explicitly-agree-to-tos/83480/40 "2018-03-23T19:24:16Z")
That’s exactly what you need, I have implemented that now at [https://monitoring-portal.org](https://monitoring-portal.org) ❤
Woltlab for example has that built-in, German company. Don’t know if it makes sense to move this into a generic setting for users, or to just leave that to the user fields (it is somewhat hard to find if you are not pointed to).
[Предыдущая страница](https://meta.discourse.org/t/how-to-make-users-to-explicitly-agree-to-tos/83480.md?page=1)
[Следующая страница](https://meta.discourse.org/t/how-to-make-users-to-explicitly-agree-to-tos/83480.md?page=3)