In 2009 the European Union has for the first time created awareness on tracking practices when the ePrivacy-Directive (2009/136/EC) was put in force. In order to comply with this directive, websites had to actively inform the visitor about the use of cookies. This disclosure has been typically implemented by showing small information banners. 9 years later, by 25 May 2018 the European General Data Protection Regulation (GDPR) came in force, which targets to regulate and restrict the usage of personal data in general, irrespective of how the information is being processed. The regulation primarily applies to so-called “controllers”, which are (a) all organizations that process personal information within the European Union, and (b) all organizations which process personal information of EU-based persons outside the European Union. Article 4 (1) defines personal information as anything that may be used for identifying a “data subject” (eg. natural person) either directly or in combination with other personal information. In theory this even takes common internet identifiers such as cookies or IP-Addresses in scope of this regulation. Processing such personal information is restricted unless a "lawful reason" according to Article 6 (1) applies. The most important lawful reason for data processing on the internet is the explicit content given by the data subject. More strict requirements apply for sensitive personal information (Art 9), which may be used for revealing information about ethnic origin, political opinion, religion, trade union membership, biometrics, health or sexual orientation. However, explicit user content still is sufficient to process such sensitive personal information (Art 9 (2) lit a). “Explicit consent” requires an affirmative act (Art 4 (11)), which is given if the individual person is able to freely choose and does consequently actively opt in.