Europe's New Privacy Law, GDPR, Takes Effect Today. Here's What Changes

BRUSSELS, May 25 - The European Union's General Data Protection Regulation, the most sweeping change to online privacy rules in decades, took effect on Friday, and inboxes around the world have been filling with "we've updated our privacy policy" emails for weeks.

The law, known as GDPR, applies to any company that collects or processes the personal data of people in the European Union, no matter where the company is based. That means an online store in Ohio with customers in Germany has to follow it. Violations can bring fines of up to 4 percent of a company's global annual revenue, or 20 million euros, whichever is higher.

The main rules: Companies must get clear, specific consent before collecting personal data, and must make it as easy to withdraw consent as it was to give. People gain the right to see the data a company holds about them, to have it corrected, and in many cases to have it deleted, often called the "right to be forgotten." Companies must report serious data breaches to authorities within 72 hours. Large processors of data must appoint a data protection officer.

The timing is notable. Facebook is still dealing with fallout from the Cambridge Analytica scandal, in which data on as many as 87 million users was improperly shared. Mark Zuckerberg testified before Congress in April, and the company's handling of user data is under scrutiny on both sides of the Atlantic.

Some companies have taken drastic steps. A number of American news sites, including the Los Angeles Times and the Chicago Tribune, have blocked European visitors rather than update their systems. Others have cut back on advertising tracking. Many small businesses say they are still unsure what the law requires of them and worry about the cost of compliance.

Within hours of the deadline, the privacy group noyb, led by the activist Max Schrems, filed complaints with regulators in several countries against Google, Facebook, Instagram and WhatsApp, arguing that they use forced consent, giving users an all or nothing choice. Google said it is committed to complying with the law.

The practical effect for many people will be more pop-ups asking about cookies and more options to download or delete their data. Whether the law changes how companies actually behave, or just how they ask permission, is a question regulators will start answering in the coming months.