# GDPR cookie law compliance + how to disable user accounts until they agree to new terms of service

**URL:** <https://discuss.openedx.org/t/gdpr-cookie-law-compliance-how-to-disable-user-accounts-until-they-agree-to-new-terms-of-service/6246>\
**Category:** Site Operators\
**Created:** [December 10, 2021, 2:29pm UTC](https://discuss.openedx.org/t/gdpr-cookie-law-compliance-how-to-disable-user-accounts-until-they-agree-to-new-terms-of-service/6246 "2021-12-10T14:29:13Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rohan](https://avatars.discourse-cdn.com/v4/letter/r/f19dbf/32.png) [@Rohan](https://discuss.openedx.org/u/Rohan)\
**Post date:** [December 10, 2021, 2:29pm UTC](https://discuss.openedx.org/t/gdpr-cookie-law-compliance-how-to-disable-user-accounts-until-they-agree-to-new-terms-of-service/6246/1 "2021-12-10T14:29:13Z")

</div>

I don’t think the GDPR actually applies to my site, both because we have less than 250 employees, and because we don’t do routine processing of data. However, I still want to do some minimal GDPR compliance just to avoid any problems down the line. I’d like to update my ToS (which must be agreed to in order to register an account), to stipulate that those who register agree to Google Analytics cookie usage (as well as Open edX cookie usage obviously.).

1. How can I disable everyone’s account, and send a link via email that says “you must agree to the new ToS to keep using your account” and/or prompt them to agree to the updated ToS on their next login? (prompting on next login would be best, because people could claim they never got the email since it went to spam…)

2. In the interest of ToS accuracy, are there any other cookies I should be aware of that get built into Open edX? E.g. due to “share this course” via Twitter?

---

<div class="post-metadata">

**Author:** ![ghassan](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/ghassan/32/2779_2.png) [@ghassan](https://discuss.openedx.org/u/ghassan)\
**Post date:** [December 13, 2021, 4:24pm UTC](https://discuss.openedx.org/t/gdpr-cookie-law-compliance-how-to-disable-user-accounts-until-they-agree-to-new-terms-of-service/6246/2 "2021-12-13T16:24:59Z")

</div>

I think this guide might help you [4.26. Enabling the User Retirement Feature — Installing, Configuring, and Running the Open edX Platform documentation](https://edx.readthedocs.io/projects/edx-installing-configuring-and-running/en/latest/configuration/user_retire/index.html) . It seems to the guide is resolving an issue very similar to your case

---

<div class="post-metadata">

**Author:** ![IvoBranco](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/ivobranco/32/2154_2.png) [@IvoBranco](https://discuss.openedx.org/u/IvoBranco)\
**Post date:** [December 14, 2021, 2:30pm UTC](https://discuss.openedx.org/t/gdpr-cookie-law-compliance-how-to-disable-user-accounts-until-they-agree-to-new-terms-of-service/6246/3 "2021-12-14T14:30:59Z")

</div>

We at nau.edu.pt project, we enforce the acceptance of the new Terms of Service when the user reenters / relogin to the platform using the User Preference API /api/user/v1/preferences/  
He needs to accept to continue to use the rest of the platform.

We have included that code directly on our Open edX platform theme.  
Link for that commit: [Merge pull request #1 from eduNEXT/ttg/featured\_modal-tos · fccn/nau-themes@817af5b · GitHub](https://github.com/fccn/nau-themes/commit/817af5b00f142ffd44e26889f43e218452d195e2)

Hope this could help you.