GDPR What Do You Need to be Compliant

Hey guys, how are you? John Thibodeau. So glad to have you guys here. Hey, I apologize about the weird room today, but I am at a school many of you guys may know in the state of Arizona. Lots of our teachers are on strike. And because of that, schools around the Valley of the sun are. They don't have any teachers to teach their kids. And so my kids sports company, shape as you can, Shape as you can see, we've been called to run emergency camps. And so I'm at one of my schools right now running an emergency camp. But I still wanted to make sure this training happens. So I'm taking a little bit of a break from, from running a camp right now. And I jumped into their classroom and I apologize that the quality may not be, the quality of the broadcast may not be as good, but the quality of content hopefully is really good. Hey, what I want to do today is I want to just do a quick little training. So many of you guys know that GDPR is coming up and May 25th is the huge day. GDPR stands for General Data Protection regulation. If you guys have been watching what has happened with Facebook and you know, some of the issues that went around with a breach of content delivery and so the feds are sort of cracking down a little bit. And now the GDPR is going to start in Europe and then it will make its way around the world. But many of us, we work with people all around the world and people purchase our stuff from all around the world. So if you do any type of online marketing, you got to be GDPR regulated because if anyone from Europe is on your list, then you could get in trouble. And the fines are pretty hefty. And I, depending on who you ask, they range anywhere from 25 bucks to 25,000 bucks for an incident. So you really need to, you really need to be GDPR compliant. And with that being said, is this is where you got to put your big, big boy, big girl pants on.

Okay?

This is where as an entrepreneur, you can't afford to buck the system here. And so because the way that this is going to be working is people are people going to be looking to make money off of this. So what's going to happen is people will red flag you, they'll find you and people behind the scenes figure out ways to make money. So you don't want to attempt to try to just sort of slide under the radar or whatever. And so now I don't in any way shape or form claim to be an expert on this, but Now, I've done a lot of research on this. I've read tons and tons of articles, but I found today what I believe is the best article and interview that I've ever seen on the topic. And when I'm done with my teaching today, I'm going to go ahead and give you a link to that so you can watch that interview in its entirety. It's from a guy by the name of Brad Klink. He was interviewed by Amy Porterfield. He's an intellectual property lawyer for entrepreneurs. And so most of this information I'm giving you today comes from him. So it's not me. So let me just give you full disclosure on this. I'm not a lawyer. I'm not trying to give you advice. What I'm trying to do is I'm trying to protect you a little bit as an entrepreneur until you get ahead of the curve. Because a lot of these things you're going to be doing, it's really, really going to impact you and affect you. Now, with that being said, what I can tell you, what I can tell you is, Jeff, the GDPR is a global, it's a global regulatory service. It is not a, it is not a United States service, okay? And so the Internet world has no boundaries. There's no legal boundaries. So it's not a US thing, it's not a Europe thing. It's whatever the eu, the European unit is putting this in place. And so just as Canada, okay? So just so Canada has a rule that when you have anybody from Canada on your list, you have to do a two step opt in form for people in Canada, okay? And Canada is its own country. They've got, they've got their own rules. And so they can come down hard on you. Trust me, they can do that. And so I want to, I just want to protect you guys. So I was going to give you some information today and let's just follow along now. Once again, GDPR stands for General Data Regulation Program, okay? And this, this regulation goes into effect May 25, 2018. And what it is is an effort to understand, it's an effort to make marketers understand why they have people in their email database and ensuring that you are using that email database responsibly and not using it in a way that the person who opted in ever intended it.

Okay?

So that's sort of what the deal is, okay? So the GDPR applies to the processing of any type of personal data. Our world is changing rapidly and they're going to be trying to protect our personal Data, your data, my data. We saw something like this happen maybe 15 years ago with the telemarketing world. It used to be with cell phones. Everybody would try to get your cell phone and try to get your landline and then, you know, info, you know, telemarketers would just bombard you like crazy. And then George Bush and his staff put in what's called the do not call list. Okay? That said anybody in North America, or at least in the United States of America, if you're on that do not call list and nobody can call you, it was an attempt to protect yourself. Okay, so what, what type of data are they trying to protect? They're trying to protect names, email addresses, physical addresses, and IP addresses. Okay, that's sort of that. Those are the big four, what they're trying to protect. Names, email address, physical addresses, and IP addresses.

Okay?

And this information typically gets collected through some kind of analytical program. Whether, whether it be Google Analytics or Facebook analytics or some type of analytics, this information gets collected from them. And what the GDPR is saying is, hold on a second. We don't mind that information getting collected, but we want the user to know about it and we want the user to be able to give consent for that. And as long as they give consent, then you can do whatever you want. But if they don't give consent, then you can't.

Okay.

So in addition to names, email addresses, physical addresses, and IP addresses, it also includes any type of processing and information that you're adding to your contact database. So many of us have a list. In fact, for many years, people say if you don't have a list, you don't have a business. Okay, list, list, list, build, build, build, build, build. Well, that's going to sort of come crashing down here because you're not. I'm going to show you in a minute, you're not going to be allowed to have anybody in your list that doesn't want to be in your list. Okay, and how many of you guys like me? I probably get 10, 2 to 300 emails every single day from list that I'm on. And to be quite honest with you, I don't really want to be on their list and I don't want to have to manually go unsubscribe. So I just deal with it. Okay, well, what this is saying is that you can't have that any longer.

Okay?

So the gdpr. Now who does this apply to? The GDPR is going to apply to any relationship or transaction, whether commercial or free, where one or more parts of one or more parties involved resides in the eu.

Okay?

So now remember, London is doing the Brexit, okay? So before too long, London's not going to count. But if you're anywhere else in the European Union and you have any of those people on your email database, that's a big deal, okay? And it's important to know that it's not based on citizenship, it's based on where they are when you are interacting with them as well. So they actually may live in North America, but they may be on a trip to Europe, know to Paris, okay? And they're in the EU and they're watching your Facebook Live or whatever they. So it depends on where they are at the time, not necessarily their citizenship, just so you know. So they could be a European citizen, but living in the United States, it doesn't impact them, okay? So if you're not online entrepreneur and a marketer based outside of the eu, you've got to comply with the GDPR when interacting with or collecting data from the people within the eu, okay? And this is where things get complicated, okay? And there's some instances where it doesn't apply, but we're not going to get into that right now.

Okay?

So here are the principles, okay? Here's the six principles of GD gdpr. Here's the pillars, okay? Pillar number one. What it says is data shall be proposed lawfully, fairly and in a transparent manner.

Okay?

So in other words, you have to be upfront about what you're collecting the data for, okay? So transparent. So hey, opt in to my list, get my lead magnet and, and I'm going to use this information for, and then you got to tell them what it's for, okay? Number two, data shall be collected for specified, explicit and legitimate purposes. So number one is it should be processed lawfully, fairly in a transparent manner, and number two, it should be collective for specified, explicit and legitimate purposes. Means you can collect data without explaining how you're using it, and those purposes have to be legit. So you can't collect any data without telling them how you're going to use it, and those purposes have to be legit. Number three, data processing shall be limited to what is necessary for the purpose. So you know, if you're, if you're collecting an email for the purpose of that is to give them your lead magnet, then you can only use that email for that purpose for giving that lead magnet. So you can't take the, take the email to give them the lead magnet and then put them into some kind of marketing sequence without you disclosing that and without them giving you permission. Number four, data shall be accurate, kept up to date and corrected. Okay, so that doesn't really apply to us. Okay, that's more Google and Facebook and the analytic people of the world. Number five, data shall be kept so it identifies a person no longer than necessary.

Okay?

So you can't keep data any longer about people forever if there's no reason to keep it. So if they opted in to get your little lead magnet, okay, and then you've given them permission, you told them that you're going to get the lead magnet plus you're going to send them five videos. And then they said, no, I don't want the five videos, then you're not allowed to keep that person in your email database any longer than what's necessary. So in other words, after you give them the lead magnet, then you've got to remove them from your database.

Okay?

Number six, data should be processed in a manner that ensures appropriate security. Okay? So you have to take reasonable steps to protect the data. And we should be sort of already have this because we use SSL certificates, especially if you're on the clickfunnels platform. So you should be, you should be good with that. Most of you don't personally store the information, use a third party software and they are typically compliant. Okay, so now how would you need to change the way that you collect email addresses from potential leads in your marketing? Okay, now once again, this is all from Dr. Klink, this intellectual property lawyer. This is not for me. What he says is the only lawful basis for adding someone to your marketing email list under the GDPR would be consent.

Okay?

And the GDPR requires that consent be freely giving, specific and unambiguous. Now watch this. Okay, this is important. Okay, this is going to be something you need need to do on your options. Now I've contacted ClickFunnels, a couple of the higher admins at ClickFunnels that I know, I personally contacted them and they told me that by May 25, by the time this thing rolls out and it's legal, that ClickFunnels will be 100% GDPR compliant. In other words, they'll have the options for you to be able to put in your opt in forms to make them GDPR compliant. But it's only gonna impact those that you create now moving forward. So you're gonna have to go retrofit all of your former opt in.

Okay?

So here's what it would look like. So we must get a separate Consent to add them to our marketing, okay? So you can't require them to give this consent as a condition for giving, getting your freebie. So if you're going to give them a lead magnet, okay, you get your little freebie that you're going to give them, okay? And you say, put your email address here so I can send you the freebie. You're going to have another box that they're going to have to check that says, you know, that they're giving you consent to enter their marketing list. If they don't give that to you, you're not allowed to put, put them in your list. But you still have to give them your freebie because the freebie no longer can be given as a condition for putting in somebody's list. Does that make sense? So they can actually give it. Now this is, this works great for me because I do the opt in is optional approach, okay? So opt ins are always optional for me. So this doesn't impact me. For those of you who use give method, you know, that's the way we do it. You have to sell products on the benefits of your list to get them to voluntarily sign up, okay? Not, not just as a requirement to get your lead magnet free or webinar registration, okay? So you have to tell the prospects, okay, when you join my list, here's the benefit to you, and then they can voluntarily sign up, okay? And so in other words, it can't be linked to them purchasing something.

Okay?

Now some of you may be asking, does this all impact people moving forward? And the answer is no. According to Dr. Klink, this new consent applies to every single person in your list. And if you can't show that you have the right of consent from people who are already on your list and to whom the GDPR applies, then you're no longer allowed to email them. Beginning May 25th, I'm going to give you some tips and tools that Amy Porterfield gives that I think are really genius and you should do.

Okay?

And I'll give you those in just a moment. Remember, consent must be specific and unambiguous.

Okay?

See what else. Okay, this is, this, here's a, here's an interesting one. Getting consent for multiple things or in the course of some other interaction is going to be really, really hard.

Okay?

You're going to need what's called stand alone consent. So in other words, so if you get the, if you get the email from, for the lead magnet, okay? So you take the email, you put them in your set, okay? And he also Says you're not allowed to add a checkbox and prohibit the delivery of the lead magnet. We've already talked about that. Okay, so question, can I send nurture sequence after someone opts in for my lead magnet under gdpr? He says it's not crystal clear, but there's a good argument for allowing you to send a nurture sequence after someone downloads your lead magnet. Okay, that would be called expanded processing. And that is when you take action after initial action. But he says factors to consider when whether it's okay or not is this one the link between the purpose of collection and the purpose for expanding processing context in which the data was collected, nature of the personal data, consequences of expanding that process. So in other words, the consequences might be getting a few emails from you. So if you opt in, this is what's going to happen and then existence of appropriate safeguards. So in other words, here's what we're doing to protect data. Okay? So you gotta, you gotta sort of be upfront about all that. This is really big because so many of us are just used to building lists and sending out broadcast emails. And what he's saying is you gotta have a lot of consent now for that. Okay, now I've got some more I want to want to talk to about how do you preserve your existing list and get compliant in just a minute. But here's what I want to tell you. Great marketers, this is not an issue for. Because great marketers only want people in their list that want to be in their list, okay? And great marketers nurture their people along, get helpful content and only. And the people in there want to be in there. So you're not gonna have any issue. Nobody's gonna turn you in, Nobody's gonna complain if you're doing it, if you're doing it this way, this is, this is really to protect you and it. And I actually think that this is gonna separate the men from the boys right here. I think that the cream of the crop, some of us, our best marketers, are going to rise to the top. And those who are wannabes, those who are spammers, those who are scammers, they're gonna be discarded, okay? So if you're good, your stuff is good, people want it, you're gonna have no problem. If your stuff sucks and you're trying to scam people, you're trying to rip people off, well, you're gonna have complaint after complaint after complaint. So just FYI. So here's what I would do, okay? So what I would do is I would start immediately by creating two lists in your database. Okay. One is you should put a list for non European Union subscribers.

Okay?

Because none of this even impacts them. And then create a list of people that are from the EU and any and anyone that you don't know and treat them as if they are okay. And then I would segment them. I'd create one list for non, one list for okay. And then what Amy recommends is you're going to re engage with the subscribers from your EU and those who are unknown before May 25. So in other words, you're going to send them a multiplicity of emails. The results of your re engagement campaign aren't going to be great. You want to figure out how you can keep people on your list without getting a new consent. From the non EU list, you can continue communicating just like you've always been. If you have people that have opted in cleanly to your newsletter to your list, you can probably put them in the okay category. These people have given you consent to receive your marketing emails.

Okay?

Now here's what she says about running an engagement campaign. She says, before you send the consent emails, first deliver extra value consistently. So in other words, start sending at least one extra email every week until May 25th. Value, value, value, value, value. Then after that, then send an email asking for consent. So you may want to send between now and then, you may want to send eight emails or seven emails. Okay? Two a week between now and then adding value. And then on that eighth email, ask for consent.

Okay?

And only to those you have to send to. You don't have to send it to everybody, only send it to those people in the eu. And make sure that you have a system set up so that when someone does consent, you're taking them off the special EU non consent list and moving them to a confirmed consent list. And I'll show you how to do that in just a minute on clickfunnels.

Okay.

It's pretty, pretty simple.

Okay?

You want to send multiple consent emails and make them enticing. Pay close attention to the subject lines. Okay? Catch your blatant subject lines. Might work really well.

Okay.

The challenge is, is you want to get people to open these consent emails.

Okay?

The only goal of the re Engagement campaign is to convince people to give you this consent.

Okay?

So you really want to make sure that it does. So here's Dr. Klink's suggestions to preserve your existing list.

Okay.

He says build goodwill by delivering amazing value. Create your list of targets from whom you need new consents. And then run engagement campaign to the list of people who need fresh consent.

Okay.

Pretty simple. It's not so difficult. Okay, so what would somebody ask him what would, what would a workaround look like? What he said you can use lead magnets to get their name and email and then try to sell them on joining your list at some point in your funnel that you're allowed to have without getting further consent. That's pretty good. He said there's four touch points to consider. He goes number one, you need to think about your opt in page, checkbox or drop down menu.

Okay.

You need a sandwich page, like a one click upsell page. You got to think about that delivery email itself. Okay. Got to think about that. And you have to think about, think about it in your lead magnet itself.

Okay.

And in the article I'm gonna share with you, he gives you all kinds of tips and tricks on what to do. He gives you where to put the policy. He gives you all kinds of things. It's an incredible article and a credible interview. So I'm going to just give you this whole thing now. Remember, I didn't make this up. This is Amy porterfields. This is Dr. Clink. So let me get some questions that you guys have and then we're gonna go. This quality is good. Hi Chad. What's up, Ancho? What's up, Kathy? Sabrina says yes. We've been working on that for some time. Awesome. Sabrina, Shane says what's up, Chad? What's up tribe? Jeff Hall. We already answered that one. I believe it's best for every entrepreneur concerned or not for now to be GDPR compliant. It's not a big deal to do it and it sits better to be prepared. Absolutely. I actually think that your conversion rate is going to go way up when you become GDPR compliant because you're only going to have the people who want to be in your list in your list which. So I think your conversion rate is going to go way up. So I love, I love this. Shane, put some articles in here. Steve, put some articles in here. Thank you guys. Yeah, absolutely. Kathy says it just seems like you get higher quality leads. Absolutely. Somebody says how can you tell who is from eu? You can't do that from an email address in that article that I send you, Sophie, you can see that.

Okay.

He shows you some ways to do that. You can probably tell that by their IP address. Okay. So far, when does it go into effect in the U.S. jeff? There's not a rollout date for the U.S. right now. We know it's coming. We just don't know when it's coming.

Okay.

We were a lot more strict. You have a lot more people fighting against it here in the United States. And so I don't know when it's coming, but I guarantee you that there's gonna be lobbyists everywhere saying that that's a violation of our constitutional rights. So. So it's probably gonna get stuck in litigation for a while.

Yeah.

Sabrina says exactly. Kathy. Less but better quality. Good stuff, guys. Good stuff. Let's see what my other room says. What's up, Rita? What's up, Michelle? What's up, Brandy? Brandy says it reminds me of all the candleloads. Yeah, there's lots of them. Joe says no. You also need to be able to delete all data. You collect all data? Yes, from people in the. You. You need to be able to delete all data. You're right about that. Rita says GDPR is European, but as long as decline customer leave carries a European passport, the law applies as far as collecting your info anywhere in the world. Rita, that's not what I'm. That's not what I'm reading. Okay. What I'm reading is that apply to people who reside in the EU or even visit the eu. Anybody who is. Who is anybody who is opting into your list from their Internet space, then it would require that. Okay, so it doesn't require. If they are in the United States.

Okay.

At least that's what I'm reading.

Okay.

But I may be wrong, but that's what this doctor called Link says, and he's sort of the authority on this, so I'm gonna rely on him. This would be a great checklist, Brandon. I send you that checklist in a minute.

Okay.

Amy Porterfield put one together. Michelle says the spammers will disappear. Charles says another issue is cookies, Facebook, pixels, and Google Analytics. I've heard these need to be opt in as well for EU they will need. What's gonna happen, Charles, is it's not gonna necessarily be up.

You got it.

You got to let them know what's happening, and they got to give you sent. So no more surprises. We could create a reverse squeeze page, and when asking for email, just sell people the idea of why they should accept it. I love that, Sergio. I love that. So I'm gonna go ahead and put this really long article in here, and then I'm gonna show you how to segment real quick. I don't have a lot of battery life left, so I'm only gonna do this for five minutes and I want to show you how to segment. I'm gonna show you how to segment this, okay?

So.

Oh, shoot. I can't. I'm not on. I can't show you how to segment. Well, I'll just show you that at another time when I'm on. When I'm on something where I can share my screen. But guys, this is gdpr. I want you to take it seriously, okay? And just see what happens.

Okay?

Now if you guys have been following the give method, we do what's called the optional opt in. The optional opt in is when you offer lead magnet. And right on the right there, you just tell them, hey, listen, this, this lead magnet is optional. You don't have to do it. But if you do it, here's what I'm going to do with your information. Here's how I'm going to be able to help you if you don't want to take my lead magnet anyway. But God bless. And what we're finding is I've got about four students who do that, and out of those four students who do that, their emails have gone down, but their conversion rate has like, quadrupled.

Okay.

Because the people in that list are the ones helping them. So I think the GDPR just probably watched our online summit and said, hey, you know, Chad's been teaching this for a while. Let's just adopt it internationally. So I think that's probably what happened.