The
California Consumer Privacy Act (CCPA) mandates that businesses honor valid “Do Not Sell” requests from California residents. In this context, complying with a valid request involves MaxMind removing IP addresses from the GeoLite2 data and communicating to GeoLite2 users that the IP addresses in question should (immediately) not be utilized for uses covered under the CCPA. We have been advised that any download, including one without charge, constitutes a sale. Serving GeoLite2 database downloads on a public page simply does not allow us to communicate and honor valid “Do Not Sell” requests we receive from individuals.
The solution we have chosen is to introduce a new end-user license agreement containing the relevant data processing provisions that both we, as the business providing data, and you, as the third party user of the data, need to comply with applicable data privacy regulations. Additionally, by requiring a MaxMind account and contact information from you, we will be able to communicate all valid “Do Not Sell” requests to you as we receive them.
With this approach, we can continue to offer GeoLite2 databases, without charge, while remaining responsible stewards of data that improves the experience of countless users across the internet.