4 ms·

How does Facebook distinguish between US and European users? Does it do it based in IP address? On GPS data it slurps up from mobile applications? On the manual

by shiado 9y ago

How does Facebook distinguish between US and European users? Does it do it based in IP address? On GPS data it slurps up from mobile applications? On the manually selected city the user specifies that they live in? Facebook also operates a TOR service, how can it comply whilst not knowing where the user is signing in from? Does a European user who uses an American VPN become classified as an American user and vice versa? There is probably a business opportunity here somewhere to provide European data privacy as a service. It all seems pretty complicated.

rando444 9y ago
European data privacy is the GDPR. If a company wants to operate in Europe and accept European customers, they abide by the law. If they can't manage to figure out they're servicing european customers and protect their data according to the law, then they get fined substantially. It might be complicated, but the onus is on the company not the user, making this Facebook's problem to resolve.
- gwright 9y ago
  This seems a bit too dismissive to me. The notion of jurisdiction for a transaction or contractual relationship is indeed pretty complicated. It isn't clear to me that the burden should be on the service provider to discern the legal domicile of a user and to be required to adjust its business practices to accommodate the regulations of their 'home' jurisdiction. Wouldn't that rapidly devolve into every service provider being required to operate within the rules of some extremely complicated intersection of all possible jurisdictions?
  - petilon 9y ago
    It is actually very simple. Ask the user. If the user says he lives in Berlin, then apply EU laws to his data. If Facebook tries to "discern" the domicile and incorrectly discerns the domicile then that's Facebook's problem.
    - jmalicki 9y ago
      And if the user says he lives in New York City, but lies, how does that remove the responsibility of Facebook to protect that users' data? It is not so simple.
      - s73v3r_ 9y ago
        Actually, it's extremely simple. Protect EVERYONE'S data. Don't care where they are.
    - Slansitartop 9y ago
      > If the user says he lives in Berlin, then apply EU laws to his data. If Facebook tries to "discern" the domicile and incorrectly discerns the domicile then that's Facebook's problem. I hope they do this, and don't try to cross-check against login IPs or anything. I just set my FB city and hometown to European ones to increase my chances of benefiting from the GDPR.
    - gwright 9y ago
      And what if the user says they live in <insert-evil-country-here>? Are you then required to apply the laws of <insert-evil-country-here>? If not, why not? Do I know need to understand the laws of every country in the world? And how to you decide between <good-country>, <so-so-country>, and <evil-country>?
      - hrktb 9y ago
        As of now, yes. If <evil country> has any leverage on your company (you have a business presence there, you travel there, or they have access to your assets) you’ll need to comply with their rules for the users living there.
  - s73v3r_ 9y ago
    Why not? Presumably they're the ones seeking to make money off the user's data; I see no problem with putting the onus on them to protect the user's privacy as well.
    - gwright 9y ago
      I think you are changing the problem definition a bit. "Protect the user's privacy" is not at all the same thing as "follow all the laws of the user's home jurisdiction". If there is a legal obligation to follow the laws regarding privacy then what about any other laws? What about disclosure laws where service providers in the home country are required to disclose information to the government? Should the foreign service provider be required to follow those laws also? If not, why not?
      - s73v3r_ 9y ago
        I think you're trying to falsely equivocate two completely separate things.
        gwright 9y ago
        I'm not equating them. I'm saying if that you argue that country-a service provider is required to follow the laws of a user from country-b, perhaps because you agree with the laws of country-b (regarding "protection of privacy" in this case), then that logic creates a problem when you don't like the laws of country-b or when they in fact conflict with the laws of country-a. I was specifically responding the the assertion that "If a company wants to operate in Europe and accept European customers, they abide by the law" and pointing out that accepting that logic may not lead where you want it to lead. Sure you can refuse to do business with customers from other countries, but now you have to have some process for determining what jurisdiction the user is from including figuring out how to protect yourself from a foreign jurisdiction that decides that you didn't do enough to discern the true jurisdiction of the user (who may have given incorrect information, clicked through the form, etc). It is not obvious exactly what would be the best way to manage that risk.
- ballenf 9y ago
  If FB took the absolute safest approach, they'd apply the restrictions to any account that has been signed in from an EU IP address -or- which lists an EU address.
fwdpropaganda 9y ago
Have you been in a coma for the past 10 years? Facebook is a surveilance company, they know everything about you. Where you are physically located was probably the bits of informaiton they learned about you.
lokedhs 9y ago
I'm curious as to whether I am covered by the GDPR. I'm an EU citizen but I live outside the EU.

by shiado 9y ago

rando444 9y ago

European data privacy is the GDPR. If a company wants to operate in Europe and accept European customers, they abide by the law. If they can't manage to figure out they're servicing european customers and protect their data according to the law, then they get fined substantially. It might be complicated, but the onus is on the company not the user, making this Facebook's problem to resolve.

gwright 9y ago
This seems a bit too dismissive to me. The notion of jurisdiction for a transaction or contractual relationship is indeed pretty complicated. It isn't clear to me that the burden should be on the service provider to discern the legal domicile of a user and to be required to adjust its business practices to accommodate the regulations of their 'home' jurisdiction. Wouldn't that rapidly devolve into every service provider being required to operate within the rules of some extremely complicated intersection of all possible jurisdictions?
- petilon 9y ago
  It is actually very simple. Ask the user. If the user says he lives in Berlin, then apply EU laws to his data. If Facebook tries to "discern" the domicile and incorrectly discerns the domicile then that's Facebook's problem.
  - jmalicki 9y ago
    And if the user says he lives in New York City, but lies, how does that remove the responsibility of Facebook to protect that users' data? It is not so simple.
    - s73v3r_ 9y ago
      Actually, it's extremely simple. Protect EVERYONE'S data. Don't care where they are.
  - Slansitartop 9y ago
    > If the user says he lives in Berlin, then apply EU laws to his data. If Facebook tries to "discern" the domicile and incorrectly discerns the domicile then that's Facebook's problem. I hope they do this, and don't try to cross-check against login IPs or anything. I just set my FB city and hometown to European ones to increase my chances of benefiting from the GDPR.
  - gwright 9y ago
    And what if the user says they live in <insert-evil-country-here>? Are you then required to apply the laws of <insert-evil-country-here>? If not, why not? Do I know need to understand the laws of every country in the world? And how to you decide between <good-country>, <so-so-country>, and <evil-country>?
    - hrktb 9y ago
      As of now, yes. If <evil country> has any leverage on your company (you have a business presence there, you travel there, or they have access to your assets) you’ll need to comply with their rules for the users living there.
- s73v3r_ 9y ago
  Why not? Presumably they're the ones seeking to make money off the user's data; I see no problem with putting the onus on them to protect the user's privacy as well.
  - gwright 9y ago
    I think you are changing the problem definition a bit. "Protect the user's privacy" is not at all the same thing as "follow all the laws of the user's home jurisdiction". If there is a legal obligation to follow the laws regarding privacy then what about any other laws? What about disclosure laws where service providers in the home country are required to disclose information to the government? Should the foreign service provider be required to follow those laws also? If not, why not?
    - s73v3r_ 9y ago
      I think you're trying to falsely equivocate two completely separate things.
      - gwright 9y ago
        I'm not equating them. I'm saying if that you argue that country-a service provider is required to follow the laws of a user from country-b, perhaps because you agree with the laws of country-b (regarding "protection of privacy" in this case), then that logic creates a problem when you don't like the laws of country-b or when they in fact conflict with the laws of country-a. I was specifically responding the the assertion that "If a company wants to operate in Europe and accept European customers, they abide by the law" and pointing out that accepting that logic may not lead where you want it to lead. Sure you can refuse to do business with customers from other countries, but now you have to have some process for determining what jurisdiction the user is from including figuring out how to protect yourself from a foreign jurisdiction that decides that you didn't do enough to discern the true jurisdiction of the user (who may have given incorrect information, clicked through the form, etc). It is not obvious exactly what would be the best way to manage that risk.
ballenf 9y ago
If FB took the absolute safest approach, they'd apply the restrictions to any account that has been signed in from an EU IP address -or- which lists an EU address.

fwdpropaganda 9y ago

Have you been in a coma for the past 10 years? Facebook is a surveilance company, they know everything about you. Where you are physically located was probably the bits of informaiton they learned about you.

lokedhs 9y ago

I'm curious as to whether I am covered by the GDPR. I'm an EU citizen but I live outside the EU.