5 ms·

Instead go and make a 'best effort' and spend a few productive weeks on getting rid of the most obvious differences between where you are today and where the la

Instead go and make a 'best effort' and spend a few productive weeks on getting rid of the most obvious differences between where you are today and where the law says you should be and you will be doing better than most and will be able to sleep just fine because just like with running away from hungry lions you only have to run faster than the competition. In our case, the best decision was to block EU traffic and ban EU users from the forums we operate. GDPR compliance for forums specifically is essentially impossible, because almost all forums allow users to embed external images. The owners of the servers on which those images reside could start deploying tracking cookies that the forum doesn't know about at any moment, and therefore there will likely be exactly 0 GDPR compliant forums, except perhaps text-only forums. That issue alone was enough to get us to block EU users, but that doesn't begin to address any of the other fine points of the law. You also seem to be uner the impression that the law will not be abused by revenue hungry governments to reach into the pockets of foreign corporations. Call me cynical, but if that doesn't happen, it would be the first time in history. The spirit of GDPR is great. The implementation is the exact opposite of great.

voltagex_ 9y ago
>The owners of the servers on which those images reside could start deploying tracking cookies that the forum doesn't know about at any moment. So... proxy the images and strip the cookies?
- downandout 9y ago
  We thought about that, but then you run into other issues. All of a sudden DMCA claims will skyrocket, bandwidth costs rise, we may get our servers blocked from retrieving images from certain image hosting services, etc. That is not a silver bullet without its own risks and additional costs.
  - Operyl 9y ago
    Having done this myself for large forums, I think we had a single DMCA. Bandwidth costs are relatively inexpensive, too. You can cache images for an indefinite amount of time, serving them over your existing CDN, and purge the older cache based on last-to-access. I've not been blocked from any image hosting sites.
laumars 9y ago
> In our case, the best decision was to block EU traffic and ban EU users from the forums we operate. GDPR compliance for forums specifically is essentially impossible, because almost all forums allow users to embed external images. The owners of the servers on which those images reside could start deploying tracking cookies that the forum doesn't know about at any moment, and therefore there will likely be exactly 0 GDPR compliant forums, except perhaps text-only forums. That issue alone was enough to get us to block EU users, but that doesn't begin to address any of the other fine points of the law. You are not going to get fined by the EU for that happening. The sites issuing the tracking cookies are the ones in breach, not you. > You also seem to be [under] the impression that the law will not be abused by revenue hungry governments to reach into the pockets of foreign corporations. Call me cynical, but if that doesn't happen, it would be the first time in history. The spirit of GDPR is great. The implementation is the exact opposite of great. I honestly cannot see that happening in this instance. Most governments bend over backwards to appease big businesses and often at the expense of consumers. What you're suggesting would be a complete U-turn on Western politics.
- downandout 9y ago
  You are not going to get fined by the EU for that happening. The sites issuing the tracking cookies are the ones in breach, not you. That's a misinterpretation of the law. We can indeed be held responsible for that - it's no different than putting a pixel on ourselves. The burden is on us to know what we are including on pages under GDPR. Most of the people in favor of this law, who claim it's not a big deal unless you have bad intentions, haven't neither read it nor spoken to legal experts about it, and are not in charge of having to comply with it themselves. If they were, most would be singing a different tune. I am not arguing that there wasn't a need for some reasonable limits on tracking. But GDPR is an atrocious law designed to allow the governments of EU countries to reach into the pockets of companies in other parts of the world (especially the US). This serves a dual purpose: to make it easier for EU Internet companies to flourish by sucking down the capital of their foreign competitors, and filling government coffers with money they aren't entitled to. That is how this law will be used, regardless of the well-intentioned hopes of those that support it.

voltagex_ 9y ago

>The owners of the servers on which those images reside could start deploying tracking cookies that the forum doesn't know about at any moment. So... proxy the images and strip the cookies?

downandout 9y ago
We thought about that, but then you run into other issues. All of a sudden DMCA claims will skyrocket, bandwidth costs rise, we may get our servers blocked from retrieving images from certain image hosting services, etc. That is not a silver bullet without its own risks and additional costs.
- Operyl 9y ago
  Having done this myself for large forums, I think we had a single DMCA. Bandwidth costs are relatively inexpensive, too. You can cache images for an indefinite amount of time, serving them over your existing CDN, and purge the older cache based on last-to-access. I've not been blocked from any image hosting sites.

laumars 9y ago

> In our case, the best decision was to block EU traffic and ban EU users from the forums we operate. GDPR compliance for forums specifically is essentially impossible, because almost all forums allow users to embed external images. The owners of the servers on which those images reside could start deploying tracking cookies that the forum doesn't know about at any moment, and therefore there will likely be exactly 0 GDPR compliant forums, except perhaps text-only forums. That issue alone was enough to get us to block EU users, but that doesn't begin to address any of the other fine points of the law. You are not going to get fined by the EU for that happening. The sites issuing the tracking cookies are the ones in breach, not you. > You also seem to be [under] the impression that the law will not be abused by revenue hungry governments to reach into the pockets of foreign corporations. Call me cynical, but if that doesn't happen, it would be the first time in history. The spirit of GDPR is great. The implementation is the exact opposite of great. I honestly cannot see that happening in this instance. Most governments bend over backwards to appease big businesses and often at the expense of consumers. What you're suggesting would be a complete U-turn on Western politics.

downandout 9y ago
You are not going to get fined by the EU for that happening. The sites issuing the tracking cookies are the ones in breach, not you. That's a misinterpretation of the law. We can indeed be held responsible for that - it's no different than putting a pixel on ourselves. The burden is on us to know what we are including on pages under GDPR. Most of the people in favor of this law, who claim it's not a big deal unless you have bad intentions, haven't neither read it nor spoken to legal experts about it, and are not in charge of having to comply with it themselves. If they were, most would be singing a different tune. I am not arguing that there wasn't a need for some reasonable limits on tracking. But GDPR is an atrocious law designed to allow the governments of EU countries to reach into the pockets of companies in other parts of the world (especially the US). This serves a dual purpose: to make it easier for EU Internet companies to flourish by sucking down the capital of their foreign competitors, and filling government coffers with money they aren't entitled to. That is how this law will be used, regardless of the well-intentioned hopes of those that support it.