Goodbye FLoC, hello Topics

Under those circumstances, I think it's pretty clear that the data subjects have given their permission.

There's a lot of FUD flying about the GDPR, and it's a good thing that it gives people control over data about them, but the central tenet is that the data subject is in control.

If the data subject CHOOSES to hand their data over to a data controller outside the jurisdiction of the GDPR, pretty much any court will be behaving lawfully when they say "more fool you" to an aggrieved plaintiff.

The point of the GDPR is to protect me if I hand over my information as, say, a condition of employment. If my employer then sells (or fails to look after properly) that data, they WILL get slammed under the regs. But if I just hand over my data to any Tom Dick or Harry, then that's *my* problem. That's why websites ask permission - if they collect it without my knowledge then they're supposed to destroy it sight unseen.

Cheers,
Wol