[edoloughlin]

This does not discuss whether nonusers will be asked to opt-in. Curious how GDPR will change tracking people w/out FB accounts.

IANAL. The only argument I'm aware of that data controllers can make for processing data without consent is if there is a legitimate interest: if the data controller needs to process the data in fulfillment of a contract/service. I wonder how this will play out for non-users. It would seem there's no legitimate interest there.

[gervase]

"In order to provide tagging service to our users, a key platform feature, we are required to maintain and process data about individuals with which Facebook, Inc. does not have a pre-existing business relationship ("Non-Users"). Failure to do so would cause substantive harm to our service, and should therefore be exempted from gathering consent from Non-Users under Article 21, Section 5 of the GDPR."

Something like that, I expect, although I'm not a lawyer either.

[zaarn]

Processing without consent doesn't work for multiple parties.

You can't claim that because you need to provide service for someone else you need to process data of non-users.

The users of which you collect data is required to be part of the service or contract to fulfill unless you have a damn good reason not to and "we need to provide this service because we go belly up otherwise" won't fly, IMO. A legitimate interest would be stuff like "we will make backups of our data, ensuring that deletion requests are carried out upon restore, to continue providing service in case of disaster" or "we will log your IP temporarily because we need to provide essential network and information security"

[Laid out in https://gdpr-info.eu/recitals/no-40/]