European Union. Article 4 (1) defines personal information as anything that may be used for identifying a “data subject” (e.g. natural person) either directly or in combination with other personal information. In theory this even takes common internet identifiers such as cookies or IP-Addresses in scope of this regulation. Processing such personal information is restricted unless a "lawful reason" according to Article 6 (1) applies. The most important lawful reason for data processing on the internet is the explicit content given by the data subject. More strict requirements apply for sensitive personal information (Art 9), which may be used for revealing information about ethnic origin, political opinion, religion, trade union membership, biometrics, health or sexual orientation. However, explicit user content still is sufficient to process such sensitive personal information (Art 9 (2) lit a). “Explicit consent” requires an affirmative act (Art 4 (11)), which is given if the individual person is able to freely choose and does consequently actively opt in. As per June 2020, typical cookie implementations are not compliant to this regulation, and other practices such as device fingerprinting, cross-website-logins or 3rd party-requests are typically not disclosed, even though many opinions consider such methods in scope of the GDPR. The reason for this controversy is the ePrivacy-Directive 2009/136/EC which is still unchanged in force. An updated version of this directive, formulated as ePrivacy Regulation, shall enlarge the scope from cookies only to any type of tracking method. It shall furthermore cover any kind of electronic communication channels such as Skype or WhatsApp. The new ePrivacy-Regulation was planned to come in force together with the GDPR, but as per July 2020 it was still under review. Some people assume that lobbying is the reason for this massive delay. Irrespective of the pending ePrivacy-Regulation, the European High Court has decided in October 2019 (case C-673/17) that the current law is not fulfilled if the disclosed information in the cookie disclaimer is imprecise, or if the consent checkbox is pre-checked. Consequently, many cookie disclaimers that were in use at that time were confirmed to be incompliant to the current data protection laws. However, even this high court judgement only refers to cookies and not to other tracking methods. Internet privacy in China One of the most popular topics of discussion in regards to internet privacy is China. Although China is known for its remarkable reputation on maintaining internet privacy among many