5 ms·

> avoid EU customers If anyone from the EU visits your website, and you're collecting server logs or analytics with IP addresses in them, you're now processing

> avoid EU customers If anyone from the EU visits your website, and you're collecting server logs or analytics with IP addresses in them, you're now processing personal data of EU citizens and subject to the GDPR. They've written this regulation such that pretty much everything on the internet is subject to it.

kodablah 9y ago
Well geo IP blocks are much easier than fetching those logs by user on request. This will happen if EU citizens overly burden companies with these letters... but not until then probably. I definitely wouldn't want to jeopardize my future EU prospects by ignoring the requests for info. It may be a bit of an unlikely scenario, but people should remember their opinions on region-specific content blocking even if they think their region has enough leverage to make everyone bend to their will.
- xg15 9y ago
  If I don't need an adblocker because all the adtech companies already preemptively block me, I personally could live with that and would consider the GDPR to be working as intended.
  - minaguib 9y ago
    It doesn't have to come to this, at least from adtech's side. Generally, your device is instructed via a publisher's site/app to reach out to ad tech servers either directly (firstparty), or indirectly (firstparty->thirdparty, firstparty->RTB exchange->thirdparty). Due to the "chaining", GDPR is particularly onerous on the adtech industry. Granted all the data is keyed by semi-anonymous IDs (cookies, IDFAs, IPs), the concerns for consent, retrievals, deletions, in a cascading manner, are an industry-wide problem requiring collective action. The IAB proposed something for the RTB side, the publishers don't like it, and it'll be tense until and through May 25th :) Having said that, nobody wants to shut-the-whole-thing-down. While all these servers may refuse service based on fuzzing the request as originating from the EU, they may also decide to serve as-best-as-possible and minimize logging of the sensitive fields - it may be better, for example, to lose some functionality for European devices (behavioural targeting, for example, the idea of showing you an ad for the Widget you just looked at over and over), than to serve nothing at all.
  - kodablah 9y ago
    Who said anything about adtech companies? I'm talking about risk mitigation here, even for fully compliant companies.
jakeogh 9y ago
Um, nope. Go ahead, try applying EU law to a US website. I run a few, by all means, knock yourself out. It's hilarious and baffling at the same time that you think the EU can write laws for other countries.
- tzs 9y ago
  If you are selling things to people in country X, you have to be very careful if you decide to ignore X's laws for such sales. You and your company may be beyond the legal reach of X, but your suppliers and service providers might not be. For example, if you decide to ignore tax laws in X, X might put pressure on your credit card processors to stop aiding your tax evasion. If the credit card processors respond by cutting off your ability to processes card, they might not bother just cutting you off from accepting payments from country X. They might cut you off completely. That would be pretty annoying.
  - jakeogh 9y ago
    That's a feature. I want to know if the people I do business with are applying laws to me that do not apply. Too "bad" about the US dropping the TPP, I assume that was the backdoor planned for "compliance".
    - ascorbic 9y ago
      If you have users in the EU then the laws do apply to you, even if you insist they do not. If you don't then you have nothing to worry about.
      - jakeogh 9y ago
        By your logic, any country can make up a law, go to my US website, and demand I follow it. Demand all you want, this is the point of national sovereignty.
        ascorbic 9y ago
tzs 9y ago
How about email? If someone from the EU sends me an email, their IP address will likely be in one of the received-from headers, and will be in my SMTP logs. Note that even if I don't have an email server, relying on my ISP to handle that, desktop email clients download the headers from the server. A lot of small businesses have no idea that they are storing that information.

kodablah 9y ago

Well geo IP blocks are much easier than fetching those logs by user on request. This will happen if EU citizens overly burden companies with these letters... but not until then probably. I definitely wouldn't want to jeopardize my future EU prospects by ignoring the requests for info. It may be a bit of an unlikely scenario, but people should remember their opinions on region-specific content blocking even if they think their region has enough leverage to make everyone bend to their will.

xg15 9y ago
If I don't need an adblocker because all the adtech companies already preemptively block me, I personally could live with that and would consider the GDPR to be working as intended.
- minaguib 9y ago
  It doesn't have to come to this, at least from adtech's side. Generally, your device is instructed via a publisher's site/app to reach out to ad tech servers either directly (firstparty), or indirectly (firstparty->thirdparty, firstparty->RTB exchange->thirdparty). Due to the "chaining", GDPR is particularly onerous on the adtech industry. Granted all the data is keyed by semi-anonymous IDs (cookies, IDFAs, IPs), the concerns for consent, retrievals, deletions, in a cascading manner, are an industry-wide problem requiring collective action. The IAB proposed something for the RTB side, the publishers don't like it, and it'll be tense until and through May 25th :) Having said that, nobody wants to shut-the-whole-thing-down. While all these servers may refuse service based on fuzzing the request as originating from the EU, they may also decide to serve as-best-as-possible and minimize logging of the sensitive fields - it may be better, for example, to lose some functionality for European devices (behavioural targeting, for example, the idea of showing you an ad for the Widget you just looked at over and over), than to serve nothing at all.
- kodablah 9y ago
  Who said anything about adtech companies? I'm talking about risk mitigation here, even for fully compliant companies.

jakeogh 9y ago

Um, nope. Go ahead, try applying EU law to a US website. I run a few, by all means, knock yourself out. It's hilarious and baffling at the same time that you think the EU can write laws for other countries.

tzs 9y ago
If you are selling things to people in country X, you have to be very careful if you decide to ignore X's laws for such sales. You and your company may be beyond the legal reach of X, but your suppliers and service providers might not be. For example, if you decide to ignore tax laws in X, X might put pressure on your credit card processors to stop aiding your tax evasion. If the credit card processors respond by cutting off your ability to processes card, they might not bother just cutting you off from accepting payments from country X. They might cut you off completely. That would be pretty annoying.
- jakeogh 9y ago
  That's a feature. I want to know if the people I do business with are applying laws to me that do not apply. Too "bad" about the US dropping the TPP, I assume that was the backdoor planned for "compliance".
  - ascorbic 9y ago
    If you have users in the EU then the laws do apply to you, even if you insist they do not. If you don't then you have nothing to worry about.
    - jakeogh 9y ago
      By your logic, any country can make up a law, go to my US website, and demand I follow it. Demand all you want, this is the point of national sovereignty.
      - ascorbic 9y ago

tzs 9y ago

How about email? If someone from the EU sends me an email, their IP address will likely be in one of the received-from headers, and will be in my SMTP logs. Note that even if I don't have an email server, relying on my ISP to handle that, desktop email clients download the headers from the server. A lot of small businesses have no idea that they are storing that information.