28 ms·

GDPR: US news sites unavailable to EU users over data protection rules

361 points by vincvinc 8y ago

koolba 8y ago
> News sites within the Tronc and Lee Enterprises media publishing groups were affected. > Tronc's high-profile sites include the New York Daily News, Chicago Tribune, LA Times, Orlando Sentinel and Baltimore Sun. Why would either of these papers be subject to the GPDR? Am I wrong in assuming they’re purely US based companies? Or is there a chain of ownership that includes EU jurisdiction?
- akie 8y ago
  If they have readers that are physically in the EU, then those readers would be covered by the GDPR.
  - jannes 8y ago
    As long as there is no business relationship to any EU entity they would not be "doing business in the EU", would they? I doubt making a website available on the global internet would be seen as "doing business in the EU".
    - danbruc 8y ago
      Doing business in the EU is only one path that causes the GDPR apply to you, processing personal data of people located within the EU, not necessarily EU citizens, is another one and probably the one relevant here. Article 3(2): This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.
      - Double_a_92 8y ago
        But what's the worst that could happen? Your site would get dns blocked in the EU?
        dageshi 8y ago
        They are perhaps owned by media organisations that do in some way do business with the EU even if those specific outlets do not.
        danbruc 8y ago
        Maybe they could arrest employees on a visit to the EU? Maybe you could even get arrested at home due to extradition agreements? Or get assets in the EU frozen or seized? But that is all pure speculation, I have no idea what actually can and can not be done or what is likely to happen.
        malka 8y ago
        as soon as some of some assets pass through entities in the EU (or even, entities on wich the EU can apply pressure), they would be seized.
    - imdutch 8y ago
      It's still unknown how exactly they will enforce the GDPR, but they've got data on Europeans thus need to comply. The US does this quite often as well having their laws applied to foreign companies, without them being physically present in the US.
  - ashelmire 8y ago
    Foreign laws are not enforceable in the US unless we a) have a treaty saying so and b) have an analogous law here. I see a lot of Europeans and tech bros that don’t seem to get this. They can make a law saying people or corporations must kiss the rings of every EU citizen no matter where they are or face fines... likewise not enforceable here, and hopefully that example makes that clear to you.
    - trothamel 8y ago
      Not sure why this is getting downvoted, since it's true. As a thought experiment, why should this have any more relevance to a company that's in the US than the Thai law that prevents criticism of their king. https://en.wikipedia.org/wiki/L%C3%A8se_majest%C3%A9_in_Thailand https://en.wikipedia.org/wiki/L%C3%A8se_majest%C3%A9_in_Thai... I suspect what we'll see soon is a law protecting US companies from EU overreach, comparable to the SPEECH ACT. https://en.wikipedia.org/wiki/SPEECH_Act https://en.wikipedia.org/wiki/SPEECH_Act It would not surprise me if some US companies are holding back, because they expect similar protections from foreign law to be passed here.
jannes 8y ago
I won't miss them. Why would I need to know about local news from places over 5000 km away? Luckily there is still archive.is and the Internet Archive for exceptional articles that pop up on HN.
- akhatri_aus 8y ago
  For many of us the meaning of the internet itself is being able to access things at 5000 km away.
  - hartator 8y ago
    No one needs that kind of access, crazy thoughts.
    - joering2 8y ago
      Bill gates agrees with you ;)
- scbrg 8y ago
  That's an surprisingly unimaginative viewpoint. Off the top of my head: - You have friends/family in that area - You actually live in that area, but you are currently travelling - You are considering visiting the area - You are doing some kind of research about the area, say, how often a certain type of crime is reported in local media I'm sure the list can be made much, much longer if we spend some time thinking about it...
lcfg 8y ago
GDPR hysteria.
- _Codemonkeyism 8y ago
  I wished everyone who says "GDPR hysteria" would cover legal costs for those who are hysteric.
  - simion314 8y ago
    For a site that shows text and images you have a simple solution change the code if(isUserInEU()) showBlobkingPopup();) else loadAllTrackingScripts(); into if(isUserInEU()) loadNonTrackingScripts(); else loadAllTrackingScripts();
    - hartator 8y ago
      Why not directly? solveAllGDPRIssues();
      - simion314 8y ago
        If you have a webpage with text and iamges, no user accounts and subscriptions then why you prefer to block the users then load the page without tracking, and show some static ads,better then nothing. Showing a popup with things like -we have Google analytics that track you in this way -we have FB scripts that do this -we have ad company X script that tracks this -we have Y product that tracks your focus .... would also be good,then I know what "I lost" not getting access to that page
        mseebach 8y ago
        No, it's not better than nothing. In fact, it's worse than nothing. Which is why they're not doing that. It's extremely difficult for classic news media to make money in the internet-world. They're not tracking you because they hate privacy, they're tracking you because they need to show you ads to earn a few cents to pay for their newsroom.
nedsma 8y ago
Here's what I get when I try to visit the LA Times: > Unfortunately, our website is currently unavailable in most European countries. We are engaged on the issue and committed to looking at options that support our full range of digital offerings to the EU market. We continue to identify technical compliance solutions that will provide all readers with our award-winning journalism.
AJRF 8y ago
Blocking access at geographic level across pretty clear signal they don't care about users/readers in those regions (I think it's hard to argue otherwise, the law has been coming for 2 years). Obviously they cater to people interested in local news in those regions. However, I hope they will rectify and allow access again for EU users at some point soon. It seems to go against the idea of a borderless internet, and I blame the companies for that, not the EU.
- _Codemonkeyism 8y ago
  They will, see my click through EULA comment.
- sschueller 8y ago
  Too bad that they would actually have to block EU citizens not territories.
  - baq 8y ago
    They're trying and it's quite effective. If they're fined (unlikely), their fine will most likely be greatly reduced.
- dorfsmay 8y ago
  > clear signal they don't care Or, it could mean they hadn't realised how much work it'd take to be GDPR compliant, and decided to temporarily use geographical blocking until they can be compliant.
  - AJRF 8y ago
    It took them 2 years to realise that? That’s the same as not caring.
    - dorfsmay 8y ago
      When you have competing priorities and finite time and budget, people often don't investigate external requirements, assuming that they'll just comply when they no longer have a choice. That's why the first few audits (SOX, PCI, etc...) for a company new to them, are always such a struggle, people starting to look at the months of work needed the same week the auditors are planned to come in. edit/PS: Did you notice how many "We changed our policy" emails you've received in the past 2 weeks, including from very large international companies like google, yahoo, etc... Companies for which not being open for business in Europe would have financially impact. Probably a good indication that they ended up with a lot more work to comply that they had anticipated, and still made it just in time. Now imagine the same situation in smaller companies running on very thin resources that cannot afford a sudden increase in staff!
firic 8y ago
Things like this will test how much EU citizens value their privacy. Of course there will be some sites they will not be able to visit but time will show if they are okay with that. These rules are very similar to rules limiting loans. No matter how desperate a person is and how low credit they have, in the US you can't give them a loan for above a certain amount of interest. That could be terrible for a poor person who is about to be evicted if they don't get some money right away. But we as a society are willing to accept that if the result is that more loans will be "reasonable". If GDPR is enforced as HN people say it will be (in a good way) then the result will probably be that a lot of free websites ban EU users and smaller companies take their place with products that either cost money or will be a bit worse. If it enforced in a bad way then big companies who can navigate the law will get bigger because their small competitors will be to afraid of the law and shut EU users out.
- imdutch 8y ago
  You can still run a free website and be compliant with the GDPR. The EU/EEA is the largest market in the world, closing yourself for an market that size will hurt more than changing a few thing to be compliant.
  - ghaff 8y ago
    >closing yourself for an market that size will hurt more than changing a few thing to be compliant Only if I make significant money from that market. If most of my revenue/profit comes from the US and it's problematic to "do business" in the EU or China, why wouldn't I want to just cut access off rather than dealing with potential hassles? The fact that it's potentially a large market is irrelevant to me. In this case, any moderately tech-savvy consumers can get to my site anyway using a VPN. But I've sent a clear message that I'm not marketing to European consumers.
    - akie 8y ago
      Well, you could! We’d be happy for you to make some space for a competitor who doesn’t make his money selling personal data.
adders 8y ago
The response to GDPR is interesting. If they are handling and selling your data in ways that are not compatible with GDPR, then you should seriously consider using someone else for that information.
- kasey_junk 8y ago
  Essentially every publisher that integrates with google might be out of compliance with the GDPR. Until that gets sorted out lots of sites are going to start doing this out of desperation.
  - jonbarker 8y ago
    That and the facebook pixel.
- lajhsdfkl 8y ago
  > If they are handling and selling your data in ways that are not compatible with GDPR Very few businesses actually sell data the way you are imagining and if all GDPR did was ban that business model I would be happy with the existence of GDPR. GDPR is much more than that and this insinuation that every business that doesn't want to deal with this hassle is somehow evil and selling ultra detailed profiles on you to the highest bidder is highly mistaken.
  - throwaway974 8y ago
    Yes, exactly. Sorry, I've been pasting this in multiple GDPR related threads, but just want people to get a concrete example of this. Here it goes: I have a profitable, bootstrapped SaaS business. It's not based on ads or selling data. I don't even have a freemium plan. Only a limited free trial after which you have to start paying. It's a trivial application that stores mostly already public data. Only email is required to login so that I can send password reset and other such communication. I've been talking to a very well known giant corporation for months. The VP and director love my product and want to start using it right away for their department. But their legal team is scared shitless with 4% fines in GDPR. They are putting some draconian clauses, (various ISO certifications and such) in the contract that I, as a small company, cannot comply. That's their interpretation of GDPR. It doesn't matter whether it's right or wrong. The VP and Director are really nice people and I've developed very good rapport with them. But I'm afraid their patience will run out soon and they'll go back to using spreadsheets. A lose-lose situation. This is the side-effect of GDPR. I'm all up for GDPR. I have uBlock, have blackholed all Facebook domains, etc. But don't assume that GDPR doesn't affect normal business transactions. Anyone who says, "Oh, how hard could it be?" has no idea what they are talking about.
_Codemonkeyism 8y ago
In 1y every website will have a click through EULA with 20 pages that loads before everything else and doesn't store IPS - and which no one is reading - privacy served. Just when they install from the App store or install Microsoft Office.
- akie 8y ago
  "Click here to agree to everything we do" schemes are explicitly forbidden by the GDPR. You need to individually opt-in to every single use case, and you need to consent to every transfer to each individual third party as well.
  - _Codemonkeyism 8y ago
    IANAL No, coupling is forbidden. A 20 page, non-legalese EULA is allowed if you don't couple acceptance to using your site. "You need to individually opt-in to every single use case" No. But I would be happy for your source on that. You can't change the usage purpose after collecting, but if you declare what you do before (20 pages EULA) data collection, you're fine. "and you need to consent to every transfer to each individual third party as well." Yes, foggy data privacy declaration from the past are no longer allowed, but 20 pages EULA, 10 pages with company listings you transfer data to are. I'd also add a teaser on top with the most important things, like here https://juro.com/#privacy-popup https://juro.com/#privacy-popup If Paypal can do it, so can you.
    - vntok 8y ago
      http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&from=EN http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... > Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided. > Where processing is based on the data subject's consent, the controller should be able to demonstrate that the data subject has given consent to the processing operation. In particular in the context of a written declaration on another matter, safeguards should ensure that the data subject is aware of the fact that and the extent to which consent is given. In accordance with Council Directive 93/13/EEC (1) a declaration of consent preformulated by the controller should be provided in an intelligible and easily accessible form, using clear and plain language and it should not contain unfair terms. For consent to be informed, the data subject should be aware at least of the identity of the controller and the purposes of the processing for which the personal data are intended. Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. > In order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation. Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.
_Codemonkeyism 8y ago
In 1y every website will have a click through EULA with 20 pages that loads before everything else and doesn't store IPs - and which no one is reading - privacy served. Just when they install from the App store or install Microsoft Office.
- addicted 8y ago
  Except that won’t help them with the GDPR one bit. They will worsen their experience and not be in compliance because they are unwilling to actually do the simple things needed.
  - _Codemonkeyism 8y ago
    IANAL but after working on GDPR topics for months with a lot of reading I'd say they would work. Selling data is still hard to argue, I'd not do that for EU citizens ("tag EU citizens to opt out from selling data"). Everything else should be possible. Using Art 6/1(a) and Art. 7 GDPR you can store most of the data from your visitor. You need to make sure they can inform them about your usage, revoke their aggreement and make you delete it. Coupling ("click EULA or else") is a little bit more difficult, but with clever UI most visitors will accept the EULA instead of opting out, no coupling needed. I'm sure in 1y publishing systems will provide all of this out of the box.
    - vntok 8y ago
      "Clever UI" (read: deceptive) tricks are obviously explicitely forbidden by the GDPR.
      - _Codemonkeyism 8y ago
        No, not a dark pattern, like LinkedIn, just a "yes" & "no", but if you place "yes" to the right side people will more likely click on "yes". If you space them at the bottom of the EULA, "no" to the left border, "yes" to the right border more people will click on "yes". This is not something I would do, but my salary is not coming from placing ads on a site and selling personal data. But this is what will happen.
Beltiras 8y ago
GDPR does not have the full force of law in Iceland but yet I am blocked. Not that I will miss those publications.
- werid 8y ago
  That's so strange, in Norway, I can still load LA Times.
  - deleted 8y ago
    [deleted]
nhebb 8y ago
I wouldn't be at all surprised if they were caught off guard on GPDR. There are some who seem to feel that the pending deadline was universal knowledge, but I don't think it was for many of us in the US. I hadn't heard of it until the recent Monal kerfuffle here on HN.
abcd_f 8y ago
What else can they do when they have this laundry list of tracking scripts on a front page: https://i.imgur.com/hKEItPS.png https://i.imgur.com/hKEItPS.png They obviously have NO idea what's being collected on every user and how it is being used.
- hartator 8y ago
  That’s the whole point of GDPR, selectively kill the web businesses they want. BBC will never be concerned.
  - yulaow 8y ago
    If those businesses are heavy shadow tracking/ads companies which don't even know which user data are they collecting, to who are they sending them and for which final use, man, I am so damn happy.
    - kodablah 8y ago
      This reads to me like a warmonger justifying innocent casualties. Surely you don't believe this only takes out the bad do you?
      - kinsomo 8y ago
        > This reads to me like a warmonger justifying innocent casualties. Surely you don't believe this only takes out the bad do you? How would it take out GDPR compliant websites? It they're not complaint, they're not exactly "innocent."
        kodablah 8y ago
        Because the risk and costs of compliance are borne by all, not just the non-compliant. I would hope that "but laws only affect the bad guys" or "if you're doing nothing wrong you have nothing to worry about" would no longer be reasonable arguments these days.
qilo 8y ago
If anyone curious to see those blocking messages for themselves, LA Times and Chicago Tribune redirect EU users to these respective URLs: http://www.tronc.com/gdpr/latimes.com/ http://www.tronc.com/gdpr/latimes.com/ and http://www.tronc.com/gdpr/chicagotribune.com/ http://www.tronc.com/gdpr/chicagotribune.com/
flohofwoe 8y ago
Alternatively there's this: https://eu.usatoday.com/ https://eu.usatoday.com/ No ads, no tracking, no cookies, not even Javascript. Just plain HTML+CSS and JPEG images. The whole front page is around 650 KByte, and by far most of this is in the image files. As a result the page looks very clean and loads very fast. This is what all news web sites should look like, not just for EU readers (although I fear that this is just a temporary solution until they've figured out that whole GDPR thing...
- toolslive 8y ago
  US users who want the same, lovely, experience can route via Europe (for now).
  - casefields 8y ago
    I just did and it's such a fantastic user experience.
- tzfld 8y ago
  And how can be a business sustainable in this way?
  - geerlingguy 8y ago
    People will actually visit the site... so they get traffic. They could then advertise to through more creative, less user-unfriendly ways (besides having giant ad networks that store tons of user data on each person, along with 20 different vendors’ trackers to make sure each department gets the same data about each user in a very slightly different way).
  - mlthoughts2018 8y ago
    One way to think of it is that “a business” is not “a user tracking, ad targeting website.” Whatever the business is, it’s not equal to the website, which is just one means of distribution of information or content. If the business was so predicated on user tracking and selling that data or using it to target ads, I think GDPR (in spirit) is saying “that’s not a business” and requiring a greater form of transparency and informed consent before a website can inflict that on a (possibly unwitting) user. I’m not trying to say this point of view is right or wrong, just that I think there is a spirit here in the intention of GDPR to say “that’s not something we’ll allow to be called a business model.” (Obviously it doesn’t fully go that far, but it’s the idea.) It’s not that different in spirit than regulating usury or payday loan businesses. If your business model profitably works only because it preys on people, the spirit of the regulation is to say, “that’s not a business model,” and regulate or disallow it. Usury laws in the case of excessive short-term interest rates; GDPR in the case of excessive user tracking and data privacy concerns. So when you ask, “how can be a business sustainable in this way?” it sort of has the wrong premise. Instead, if the business could not be profitable without this then it wasn’t actually ever a business— rather it was some other data exploitation entity, and the lack of an alternate way to be profitable in compliance with GDPR is a signal that the entity was unable to determine a way to exist without causing the kinds of harm that GDPR aims to prevent. Again, I’m just trying to represent what I think the spirit is behind the GDPR choices— not saying they were right or wrong.
chatmasta 8y ago
I'm in the UK atm. I just took a look at CNN.com, and uBlock is still blocking dozens of trackers there. I disabled it to see if I would get a GDPR consent popup, but all I saw was an accept cookies notification, nothing about the dozens of third party trackers on the site, other than some sparse information. There is no way to opt out of them, and there is only an “I accept” option on the accept cookies box. So CNN is not GDPR compliant, even though they've been running stories about it recently?
Agathos 8y ago
Obligatory link to the original tronc vision: https://www.youtube.com/watch?v=OtwiWd1LTeg https://www.youtube.com/watch?v=OtwiWd1LTeg
miabiel 8y ago
What about EU citizens residing outside the EU? Banning visits from EU aren't avoiding the GDPR problem.
- whyever 8y ago
  I don't think they are protected outside the EU.
- pluma 8y ago
  The GDPR is about EU residents, not citizens. You don't need to be a EU citizen but you do need to be in the EU at the time.
ashelmire 8y ago
...and little of value was lost. American news sites are overwhelmingly filled with nonsense. But really, I’m surprised they even bother to block EU users. Not like the GPDR can really be enforced in the US.
zerostar07 8y ago
Well we still have HN, even if non-compliant.
- jacquesm 8y ago
  Why is HN non-compliant? They use Cloudflare which has gone out of their way to be compliant (to the point of offering US citizens and the rest of the world the same protections as EU citizens), and nothing else is included on the page that could track you (check it if you don't believe me). You can anonymize your profile, you can edit it and you can use one of several services to get your data out. On the whole it is pretty good.
  - dmitriid 8y ago
    > Why is HN non-compliant? > They use Cloudflare Just the fact that you use some GDPR-compliant service doesn't mean that your product is GDPR-compliant. Because your product has to make sure that it stores, processes, removes, rotates etc. personally-identifiable data in a GDPR-compliant way. E.g. HN doesn't offer a way to request the data they have on me, or to delete my account. This is not GDPR-compliant.
    - adrianmsmith 8y ago
      It only "doesn't offer a way" if you write an email to HN and they refuse to do it, or don't answer. I haven't requested that myself, so I don't know what answer you'd get. But I think, unless there's evidence that someone's got such an answer from them, it would be wrong to assume they won't/can't do it. Deleting data etc. doesn't have to be automated i.e. with a button to do it. Writing to them and them doing it is sufficient.
      - jacquesm 8y ago
        Spot on. That's exactly how it is. It would be nice if the GDPR mandated automated procedures for all of the above that are no more complex than it is to sign up and post in the first place. But that's not quite how it works. There are such requirements in some of our laws with respect to signing up and cancelling paid services.
mrfusion 8y ago
Is blocking a legal way to comply with gdpr? Surely you can’t identify all Eu-ians? Does the law just care that you made an effort to block them?
- Sargos 8y ago
  Yes. Intent matters. The website is showing that they do not want EU visitors as they don't want to deal with the high cost of GDPR. If an EU visitor manages to bypass this restriction in some way like a VPN then they lose their EU protection as they are hiding their identity as a EU citizen.
throwawaymanbot 8y ago
Its almost like they didn't try, due to making so much money selling user data. And blocking EU users is a childish attempt at protest. Places that DID respect user data to begin with have not had to do this. Which makes me actually wonder what horrors are going on with data we dont know about.
millette 8y ago
From Canada, http://www.thesuburban.com/ http://www.thesuburban.com/ too is unavailable in Europe due to GDPR.
TorKlingberg 8y ago
I am worried regulations will make the Internet more geographically fragmented. The best thing about the Internet is how it captures the long tail. A random person in Slovenia can read a local news site in Kansas if they wish. Even if spending just one minute of effort making itself available in Slovenia would be a loss for said news site. The Internet is by default global and everything is available to everyone. It takes extra effort to block regions, but I'm afraid regulations will make people spend that extra effort.
- adventured 8y ago
  There's no scenario where the 'open' Internet doesn't rip apart. Globally there will be dozens of GDPR type regulations, and that's just covering privacy. There will be a lot more for economic rules, cultural rules (eg governing speech), etc. Want to operate a service in 100+ countries? You'll have to comply with thousands of rules. Only giant companies will be able to do it. It's already extremely difficult to do. In the physical goods world, generally only very large companies can operate in 100+ countries; that's exactly how it will be for Internet companies in the near future. In the case of the US, there will be an immense advantage for tech services & sites. I can make a lot of money on ads just in the single large US market, far more than necessary to support a global operation. I can then project out into the rest of the world, without concern for complying with everyone's individual rules (unless it makes economic sense). For those localities to stop me, they all have to implement draconian Chinese-style repression of their people and what they can see online (which most will not do).
  - lajhsdfkl 8y ago
    I really think the EU guaranteed US tech dominance with this law. How many months of work did the EU just add to getting out an MVP? How are EU startups even going to do AB testing to improve their product without collecting user data?
    - M2Ys4U 8y ago
      I suggest you actually read the GDPR (for legislation it's actually quite readable) before spouting off nonsense like this. >How many months of work did the EU just add to getting out an MVP? None. >How are EU startups even going to do AB testing to improve their product without collecting user data? The same way they always have.
tomatotomato37 8y ago
Explain to me again how this won't functionally turn into the EU version of FOSTA?
tracker1 8y ago
Honest hypothetical question... my website is in the US, my servers in the US, why would I care about the GDPR?
- orwin 8y ago
  if you don't deal with EU customers (like if you don't sell ads to EU advertisers), you don't have to.
- CodeSheikh 8y ago
  Does your website serve users from EU region or do you intend to block incoming traffic form EU? If you serve them then you might want to collect some data points about them. It is like being on the internet you are by default given a chance to operate business (website in this case) in whatever country a user access your website from. You are not going to open a franchise in Germany and not abide by their local laws concerning about German shoppers right?
  - ryanwaggoner 8y ago
    This is an insane argument. So now by having a blog, I’m under the jurisdiction of 200 countries and countless other small jurisdictions? What happens when they all contradict each other? Or when I can’t tell what jurisdiction a user belongs to? Or when they pass crazy laws like anti-blasphemy or demand half my revenue, or whatever? I don’t think you’ve thought this through.
    - buckminster 8y ago
      > So now by having a blog, I’m under the jurisdiction of 200 countries and countless other small jurisdictions? Guess what? You already are. For example, if you insult the Thai king on your blog and you visit Thailand you can be prosecuted. This has happened. Of course, you can't be extradited for this. But if you are a notorious online controversialist you should be careful where you travel.
      - 8y ago
yeeeeeeeeee 8y ago
Regardless of GDPR, this is good in the short term. Organizations can comply with regulations (and ostensibly reduce market failures) or not comply and lose market share. If all regulations fell into the former camp we haven't tried enough strict regulations. More generally I think a big problem with compliance is 1) Current business model practices. We don't know how all the ways to make money on the Internet because it hasn't been around that long so we just sell data/ads. 2) Technical limitations. The Internet is organized around centralized systems but this doesn't have to be the case. It's just hard to build a comparable decentralized system easily with the current tools.
- fredley 8y ago
  I agree with this, and hope that it will cause innovation on both points. I know there are a lot of regulation-phobes on here, but good regulation is a driver of (good) innovation, as opposed to further innovation in fields like spying on customers and exfiltrating as much data on them as possible. Innovation will always be made, and I feel that currently, many great minds are being utilised to make people click on ads. Hopefully this is a step towards changing that.
awat 8y ago
On one hand I can understand why some orgs are having trouble with GDPR. On the other hand it’s pretty clear the actions of more than a few have gotten GDPR to where it is. My takeaway at the moment is something along the lines of this is why we can’t have nice things.
- dominotw 8y ago
  I attribute it to European jealously over american tech success. Hi tech success that flies in the face of their supposed social, cultural and moral superiority. User tracking is not really why we don't have nice things, look at the success of moviepass even after they publicly admitted what they were tracking. People want part of the spoils which is exactly the purpose of GDPR.
  - gcthomas 8y ago
    Isn't Moviepass hæmmoraging $20 million a day while its share price tanks? No, if you knew how Europeans think, you'd realise that this is really just about securing privacy. Most of the regulators are really focussed on ensuring compliance, not levying fines.
    - getsugablitz2 8y ago
      They're losing $20 million a month, if they were losing that per day that'd really be something. Probably would be out of business in a few weeks.
    - dominotw 8y ago
      > Isn't Moviepass hæmmoraging $20 million a day while its share price tanks? Correct me if I am wrong. But that just proves my point rather than yours, correct? They are losing so much from ppl using not because ppl are quitting it due to privacy concerns.
      - gcthomas 8y ago
        They are losing money because they have an unsustainable pricing model. Other cinema services were saying Movie pass would fail as soon as they started.
OrganicMSG 8y ago
Technically, this would seem true for a lot of things.
deleted 8y ago
[deleted]
Yabood 8y ago
There are so many wrong things with this approach. First, what do you do when you have existing users, delete them? Second, I believe the law protects EU citizens regardless of where they are. If you're an EU citizen and register for a service somewhere in the US using VPN or while physically being outside the EU, that service/company will still need to comply. The safest approach is to comply. We're a tiny startup, but we decided to bite the bullet and comply because its much easier and quite frankly better for all in the long run. Oh and, disclosure sets you free.
- adventured 8y ago
  > Second, I believe the law protects EU citizens regardless of where they are. That's incorrect. That is the attempted naive reach of the EU in action. The correct formulation is: the EU would like for GDPR to apply to all EU citizen data globally. US sites/services with no business reach into the EU, do not need to comply with EU privacy laws. 99% of businesses around the world (most small businesses), those outside of the EU, will entirely disregard GDPR - because they have no business dealings with the EU. The EU has no jurisdiction over the US economy or its laws. That will remain the case. The EU also doesn't control China, or India, or Japan, or Brazil, or South Africa. A simple example for illustration: I can establish a new US service that is ad based (with eg 100% of revenue being derived from the US market), I can keep all of my infrastructure & business operations outside of the EU, I can take on EU users at will, and I can do anything I want to - in compliance with US law - with their information without concern for GDPR: because the EU does not lord over the US, their laws do not rule the US. This is legally how GDPR actually works, despite the amusing propaganda campaign to pretend GDPR requires global compliance.
  - gcthomas 8y ago
    Only until the TTIP treaty gets finalised! Then there may be a mechanism for some comeback.
  - strictnein 8y ago
    > the EU does not lord over the US, their laws do not rule the US. This is legally how GDPR actually works The number of people who have lost sight of this is unbelievable. It actually seems especially rampant on HN, which is kind of surprising, to be honest.
mrmekon 8y ago
I'm in the EU, and a couple of the corporate VPNs I have used here have had their exit IP in the U.S. or Canada. Which means that when I'm at work, I appear to be in Seattle, and these sites are not blocked. Based just on that, I'd argue that "Blocking 500M Users Easier Than Complying with GDPR" is probably not even a true statement. I doubt EU regulators will go after these sites because they really aren't that consequential, but I wonder if setting up an IP block isn't just painting a target on yourself. It's basically a statement that the company was and still is violating GDPR.
- ryanwaggoner 8y ago
  What exactly do you want here? Do you want every site to have you upload your passport? Or are you just saying that any jurisdiction in the world should be able to effectively force every company globally to comply with their laws, and that they can’t pull out of those markets if they find the law too onerous? Forget about the intent of the GDPR, what about the broader principle when applied to laws you don’t like? What if the US passes the anti-GDPR next week, that you MUST track all available data for US residents or citizens, no matter where in the world they are? What then?
  - mrmekon 8y ago
    My comment doesn't make a statement about how things should be. It's a statement about the complexities of a technical implementation: _If_ it is true that the GDPR covers an EU person's data held by any company worldwide, regardless of how or whether it should, an IP block might not be accepted as compliance. Or it might, if the EU regulators decide that best-effort is enough. The important point is that many Europeans are browsing the net through non-EU IP addresses without the knowledge that they are doing so. Most people do not pay attention to what their corporate public IP address is. They may use "non-EU" services entirely unintentionally, and EU regulators may or may not take that into account in the unlikely case that they investigate one of these companies.
    - sb8244 8y ago
      I am curious how this will play out. I am not sure how else EU regulators could play it out without essentially saying that all users must identify themselves honestly to a site. What happens if a person marks their country of origin as US even if they aren't in the US and their IP isn't. They lie in that case, but are they still protected?
rdlecler1 8y ago
They claim that everyone had a lot of time, but what about the 1-3 person startup that’s been around for 4-5 years who is just getting by and didn’t have the resources to re-engineer their entire application or to write up a complex privacy policy or hire an EU Representative (Yes, apparently that is required as well). If the EU does clamp down on forced consent I think the long tail of small startups and publications and side projects will simply block EU visitors because they won’t have the means to become compliant. I’d be interested to hear how problematic this is for new startups who are building GDPR complianance into the systems from scratch. It would seem to amount to needed bespoke permissioning for every user because forced consent is not permitted (although being widely used).
- cortesoft 8y ago
  If your startup doesn’t have any business in the EU, they can’t go after you.
  - oaiey 8y ago
    "Business" means website visit from a US/EU citizen travelling Europe. And even blocking them by IP and logging it is a violation. User can file a complaint against you, resulting in a ruling. Whether you ever see an "invoice" or see police officers is another topic. But you violate the regulation/law in another country.
    - majewsky 8y ago
      Blocking by IP is okay, logging it is the only violation. And why on earth would you have to log those blocks?
      - oaiey 8y ago
        That's right!
      - cortesoft 8y ago
        You would want to log it to make sure you aren't accidentally blocking the wrong people.
AndrewKemendo 8y ago
This seems 100% rational. If the sites determined that they cannot or will not show ads in compliance with GDPR, then why would they pay for the bandwidth it takes, knowing they can't monetize it without being in violation? It's the equivalent of the whole of the EU putting uBlock on their computers. Companies that make the majority of their money on advertising are responding.
kartan 8y ago
Business don't comply with regulations because it is easy, but because it's needed to do business. If a service didn't had a big user base in Europe, most countries don't speak English, it may be cheaper to remove the service. The New York Times or The New Yorker that even have physical copies available in Europe work as usual. I work in a gambling company and this is our day to day business. To enter a new market means to follow a new set of regulations. To do the adaptation or not is an strategic decision based in complexity, expected revenue and other factors. GDPR is just another regulation to add to the long list related to tax evasion, responsible gambling, fair play, etc.
- rdlecler1 8y ago
  Regulations tend to favor incumbents, decreasing competition, and thereby increase monopoly and creating central hubs of systemic risk. There is no free lunch with one-size-fits-all rule making. Unfortunately regulators think there is.
  - fixermark 8y ago
    And when it comes to European business law in particular, there's no reason to believe favoring incumbents and decreasing competition isn't an intended benefit. When Amazon entered the French market, it tripped over laws putting a floor on discounts allowed that are intended to protect book sellers, not purchasers.
  - hau 8y ago
    Can you back up such strong and broad claims with something?
    - baxtr 8y ago
      Not every claim on HN needs a backup. This one makes total sense to me. In this case, the article itself shows that regulation is definitely decreasing alternatives, which in turn can lead to monopolies
      - 8y ago
fiatjaf 8y ago
Shameless self-promoting an easy solution for your small site, if you too want to get rid of EU people: https://euroshield.xyz/ https://euroshield.xyz/
Double_a_92 8y ago
All those pages seem to block the entire continent not just the EU. I'm in Switzerland (not in EU) and still get blocked.
rdlecler1 8y ago
GDPR is significant because for the first time in this history of the Internet an (EU) user no longer has a marginal cost of zero. The cost to write an application to be GDPR compliant is high and frankly will not be worth it for many entepreurs developing an MVP.
- fastball 8y ago
  That's not true at all. It's really easy to build an MVP that complies with GDPR.
  - rdlecler1 8y ago
    Really? Do you have an EU representative for your MVP? Did you hire a legal team to review your site and write up your terms of service? Send me your MVP and I’ll show you 10 thing a that are wrong with it and if you are complaint somehow then I doubt the product will be viable at all.
    - matwood 8y ago
      So my MVP is an imaginary service that does X for you. It charges $5/month and it uses your email as the log in. It captures no data other than what you give it to do said service. Other than good data practices which should be followed anyway, please described the huge GDPR hurdles that will make this service not viable.
      - ithkuil 8y ago
        Apparently you need to appoint a Data Protection Officier and you cannot just be e.g. CEO, developer and DPO at the same time. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-officers/ https://ico.org.uk/for-organisations/guide-to-the-general-da... > Basically this means the DPO cannot hold a position within your organisation that leads him or her to determine the purposes and the means of the processing of personal data Are there exemptions for very small companies? If you can prove you don't process any user data, at all, does this exempt you from having to appoint a DPO?
dmitriid 8y ago
""" USA Today stops tracking EU citizens. Americans/others are still fair game. When it comes to privacy, Americans are now formally 2nd-class world citizens. """ https://mobile.twitter.com/aral/status/1000005956493770753 https://mobile.twitter.com/aral/status/1000005956493770753
rdiddly 8y ago
Europeans just found out which US sites were tracking and profiling them.
shadowtree 8y ago
Well - what does this mean for US citizens then? If those site violate GDPR laws, what exactly are they doing with user data, how are they securing it? Do they even know what's going on? Good litmus test for privacy/info sec readiness in corporations.
ryanwaggoner 8y ago
I hope we get a LOT more of this. If the EU wants to pass laws that say every company around the world (almost all of which have ZERO democratic representation in EU government) has to fully comply or face huge fines that will drive them out of business, let’s see how they feel when all those companies just shrug and turn their back on the market. I know the GDPR fans here will just say “good, we’re better off without them!” and I guess on that we agree. Go in peace.
- mark_l_watson 8y ago
  Hello Ryan (I like your business advice newsletter), honest question: In the USA we have FICA laws that can fine foreign banks, in foreign countries, not here, for most of a year’s income if they make a single error in reporting financial,records of US citizens. Most banks in foreign countries simply refuse US citizens as customers. How ae laws like FICA OK but not GPDR?
  - ryanwaggoner 8y ago
    Thanks for the kind words re: newsletter :) Are you thinking of FATCA? I’m not an expert, but from what I can tell, I’m not a fan. I think telling US citizens that they have to report is fine, asking foreign banks to report is fine, and requiring foreign banks that also have a US presence to comply is fine. But if FATCA applies to some small community bank in Japan, then that’s ridiculous.
nominated1 8y ago
As a non EU member I'm jealous. I would love to see a uBlock filter list targeting all non GPDR compliant addresses. Maybe something like the 'Badware risks' list that allows you to proceed but not before displaying a warning.
natch 8y ago
Are there any publicly traded VPN providers?
WindowsFon4life 8y ago
s/news/propaganda
throwaway974 8y ago
I have a profitable, bootstrapped SaaS business. It's not based on ads or selling data. I don't even have a freemium plan. Only a limited free trial after which you have to start paying. I've been talking to a very well known giant corporation for months. The VP and director love my product and want to start using it right away. But their legal team is scared shitless with 4% fines in GDPR. They are putting some draconian clauses, (various ISO certifications and such) in the contract that I, as a small company, cannot comply. That's their interpretation of GDPR. It doesn't matter whether it's right or wrong. The VP and Director are really nice people and I've developed very good rapport with them. But I'm afraid their patience will run out soon and they'll go back to using spreadsheets. A lose-lose situation. This is the casualty of GDPR. I'm all up for GDPR. I have uBlock, have blackholed all Facebook domains, etc. But don't assume that GDPR doesn't affect normal business transactions. Anyone who thinks, "Oh, how hard could it be?" has no idea what they are talking about.
ams6110 8y ago
Facebook, Google, Instagram and WhatsApp are accused of forcing users to consent to targeted advertising to use the services. Privacy group noyb.eu, led by activist Max Schrems, said people were not being given a "free choice". I mean, that just isn't a valid complaint IMO. You have a choice -- you can not use Facebook, or not use Google, or not use Instagram, or not use WhatsApp. If you're using a "free" service that is ad-funded, why do you think you have a right to use it without consenting to the ads?
- freeflight 8y ago
  It is a very valid complaint and becomes even more valid as Facebook is scrutinized even further. Zuckerberg's EU hearing was a rather good indicator of where this is heading when MEP's specifically singled out: - Facebook's business practices in general, the MEP's do not believe that what Facebook is doing can be done in the same way while respecting users privacy. Thus they kept asking how Facebook is planning to monetize it's service in the future while respecting their user's data. - Having Facebook admit to its monopoly position in the EU by asking Zuckerberg for any Facebook competition he knows of, in the EU. There's also this whole issue with Facebook simply slurping up WhatsApp, and all its user's data, even tho WhatsApp users never consented to any of that. I made a point of never giving Facebook my mobile number, a point that's made completely irrelevant when Facebook just throws money around to get any data they want complete with some manufactured opt-out consent.
- king_phil 8y ago
  Then you don't understand the most fundamental thing about the GDPR: "Kopplungsverbot" (german privacy law had that for ages before GDPR). You can't force someone to consent to marketing because he wants to use your service. Everything that is not part of the core service needs consent that can be withdrawn at every time. The core service of facebook is access to the network, not that my data is processed to show me better advertising. The advertising is in facebook's interest, not mine. "But we make our revenue from ads" is not a valid explanation. If your service was "sign up to see better ads", then that would be your core business and no consent needed. Best thing ever happend.
  - 8y ago
ryanwaggoner 8y ago
What if the US to passes a law that Americans are too fat and are no longer allowed to be sold gelato (they're allowed to buy gelato, but no longer allowed to be sold gelato), and then levy a multi-million dollar fine against every gelato shop in Italy where Americans visit on vacation. How is that different from the GDPR?
- craigsmansion 8y ago
  The difference is that one is an example of actual and well-thought out legislation in the EU which is generally welcomed by the people most affected by it: EU citizens. The other is a trumped up example by someone on whom the GDPR self-admittedly has hardly any bearing but who still insists on throwing a hissy fit because legislation is somehow un-american or something.
  - ryanwaggoner 8y ago
    I disagree on "well thought out", but it doesn't really matter. I don't think that legislation is "un-american" or that the EU shouldn't have passed this law for its citizens. My issue is with the attempt to declare that it applies so broadly to organizations in other countries who have no connection to the EU except that EU visitors might come to their website. I'm going to assume you're intentionally not trying to understand the broader principle here, but just in case: Reposted from another comment: My primary argument is that the GDPR's attempt to regulate companies in other jurisdictions because EU citizens go INTO those jurisdictions and do business is a dangerous precedent. If there was an enforcement mechanism for all such laws, it implies that any business or individual anywhere in the world with a website should therefore have to comply with any laws from any jurisdiction that are similarly constructed. If my website says things about Islam that Saudi Arabia passes a law against, I should be fined. If my website disrespects the king of Thailand, I should be extradited for imprisonment. If I encourage NK citizens to revolt against their oppressive regime, I should end up in a labor camp. After all, those governments have a right to say that if I want to "do business in their jurisdiction", I must respect their laws, right? (To be clear, I'm not talking about enforcement of these kinds of laws, because all of those countries might do the above if given the chance. I'm talking about what I SHOULD do as a matter of morality or ethics or civic duty or whatever, or what my government should cooperate with those governments on, because it's just.) But the problem is that they're describing "doing business in their jurisdiction" as a citizen from their country (maybe even one who is currently visiting my country) going online and sending my server requests, data, and money. And apparently explicitly telling those citizens to please NOT do that, or blocking them, is not sufficient. The only way to make the majority of the EU users on HN happy is to comply. Why would that same logic not apply to all other kinds of laws?
textmode 8y ago
The limitations of internet technology means that any computer located in the EU, whether or not the user controlling it is in the EU, can enjoy the beneficial effects of the GDPR. (Those limitations and effects being in part that companies will attempt to distinguish EU natural or legal persons based on IP address.) The GDPR finally provides a legitimate, compelling rationale for users to employ longstanding methods of partially controlling the flow of their traffic through the internet, e.g. setting up a hosting account that uses servers located in the EU and using those computers to access www sites. An ssh account on a server located in the EU has gained new value. Accessing the www from a computer located in the EU has new advantages, thanks to the GDPR. To users who are aligned with the goals of the GDPR, it is possible that www sites located in the EU have become more appealing than those located outside the EU. How will EU news sites treat users from outside the EU? Is there a benefit to using EU news sites from outside the EU?
- M2Ys4U 8y ago
  >GDPR only applies to EU citizens. No, it doesn't. It applies to natural persons in the EU. Article 3 GDPR: --- Territorial scope 1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. 2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union. --- Note that the above does not reference citizenship.
TomAnthony 8y ago
(Reply to a deleted comment on the burden of compliance as a US business) If you truly do intend to take good care of your users’ data, then the goal should be to have you demonstrate that whilst making it as easy as possible for you to do so (without compromising the said care). I’m hoping that over the coming weeks and months the enforcement of GDPR and various court cases will add clarity and allow the development of improved guidelines for becoming compliant. If a random SaaS company that users emails for logins and communication with active customers could look at a simple 5 point check list which they could check though in a day then things would be better for everyone. Less burden for customers, wider services for users, and those firms that can see they could make a few small changes to become compliant would be more incentivised to do so.
muzani 8y ago
Can't break privacy laws if you don't have any customers.
Tomte 8y ago
We're so acclimated to having no choice that I was genuinely surprised when I clicked on "Do not accept" at the http://politico.com http://politico.com web site and... nothing bad happened. I could read it as always. Clicking "Do not accept" made me nervous and feel somewhat rebellious.
notananthem 8y ago
Trib and Daily News are not journalism lol
t0mbstone 8y ago
Can someone explain to me how the EU is planning on enforcing GDPR on US-based companies? And even with EU companies, without some kind of third party auditing, how can you actually believe anyone's privacy policies which claim to conform? What's actually preventing everyone from just claiming that they are following it, and then secretly breaking the rules?

361 points by vincvinc 8y ago

> News sites within the Tronc and Lee Enterprises media publishing groups were affected. > Tronc's high-profile sites include the New York Daily News, Chicago Tribune, LA Times, Orlando Sentinel and Baltimore Sun. Why would either of these papers be subject to the GPDR? Am I wrong in assuming they’re purely US based companies? Or is there a chain of ownership that includes EU jurisdiction?

akie 8y ago
If they have readers that are physically in the EU, then those readers would be covered by the GDPR.
- jannes 8y ago
  As long as there is no business relationship to any EU entity they would not be "doing business in the EU", would they? I doubt making a website available on the global internet would be seen as "doing business in the EU".
  - danbruc 8y ago
    Doing business in the EU is only one path that causes the GDPR apply to you, processing personal data of people located within the EU, not necessarily EU citizens, is another one and probably the one relevant here. Article 3(2): This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.
    - Double_a_92 8y ago
      But what's the worst that could happen? Your site would get dns blocked in the EU?
      - dageshi 8y ago
        They are perhaps owned by media organisations that do in some way do business with the EU even if those specific outlets do not.
      - danbruc 8y ago
        Maybe they could arrest employees on a visit to the EU? Maybe you could even get arrested at home due to extradition agreements? Or get assets in the EU frozen or seized? But that is all pure speculation, I have no idea what actually can and can not be done or what is likely to happen.
      - malka 8y ago
        as soon as some of some assets pass through entities in the EU (or even, entities on wich the EU can apply pressure), they would be seized.
  - imdutch 8y ago
    It's still unknown how exactly they will enforce the GDPR, but they've got data on Europeans thus need to comply. The US does this quite often as well having their laws applied to foreign companies, without them being physically present in the US.
- ashelmire 8y ago
  Foreign laws are not enforceable in the US unless we a) have a treaty saying so and b) have an analogous law here. I see a lot of Europeans and tech bros that don’t seem to get this. They can make a law saying people or corporations must kiss the rings of every EU citizen no matter where they are or face fines... likewise not enforceable here, and hopefully that example makes that clear to you.
  - trothamel 8y ago
    Not sure why this is getting downvoted, since it's true. As a thought experiment, why should this have any more relevance to a company that's in the US than the Thai law that prevents criticism of their king. https://en.wikipedia.org/wiki/L%C3%A8se_majest%C3%A9_in_Thailand https://en.wikipedia.org/wiki/L%C3%A8se_majest%C3%A9_in_Thai... I suspect what we'll see soon is a law protecting US companies from EU overreach, comparable to the SPEECH ACT. https://en.wikipedia.org/wiki/SPEECH_Act https://en.wikipedia.org/wiki/SPEECH_Act It would not surprise me if some US companies are holding back, because they expect similar protections from foreign law to be passed here.

jannes 8y ago

I won't miss them. Why would I need to know about local news from places over 5000 km away? Luckily there is still archive.is and the Internet Archive for exceptional articles that pop up on HN.

akhatri_aus 8y ago
For many of us the meaning of the internet itself is being able to access things at 5000 km away.
- hartator 8y ago
  No one needs that kind of access, crazy thoughts.
  - joering2 8y ago
    Bill gates agrees with you ;)
scbrg 8y ago
That's an surprisingly unimaginative viewpoint. Off the top of my head: - You have friends/family in that area - You actually live in that area, but you are currently travelling - You are considering visiting the area - You are doing some kind of research about the area, say, how often a certain type of crime is reported in local media I'm sure the list can be made much, much longer if we spend some time thinking about it...

lcfg 8y ago

GDPR hysteria.

_Codemonkeyism 8y ago
I wished everyone who says "GDPR hysteria" would cover legal costs for those who are hysteric.
- simion314 8y ago
  For a site that shows text and images you have a simple solution change the code if(isUserInEU()) showBlobkingPopup();) else loadAllTrackingScripts(); into if(isUserInEU()) loadNonTrackingScripts(); else loadAllTrackingScripts();
  - hartator 8y ago
    Why not directly? solveAllGDPRIssues();
    - simion314 8y ago
      If you have a webpage with text and iamges, no user accounts and subscriptions then why you prefer to block the users then load the page without tracking, and show some static ads,better then nothing. Showing a popup with things like -we have Google analytics that track you in this way -we have FB scripts that do this -we have ad company X script that tracks this -we have Y product that tracks your focus .... would also be good,then I know what "I lost" not getting access to that page
      - mseebach 8y ago
        No, it's not better than nothing. In fact, it's worse than nothing. Which is why they're not doing that. It's extremely difficult for classic news media to make money in the internet-world. They're not tracking you because they hate privacy, they're tracking you because they need to show you ads to earn a few cents to pay for their newsroom.

nedsma 8y ago

Here's what I get when I try to visit the LA Times: > Unfortunately, our website is currently unavailable in most European countries. We are engaged on the issue and committed to looking at options that support our full range of digital offerings to the EU market. We continue to identify technical compliance solutions that will provide all readers with our award-winning journalism.

AJRF 8y ago

Blocking access at geographic level across pretty clear signal they don't care about users/readers in those regions (I think it's hard to argue otherwise, the law has been coming for 2 years). Obviously they cater to people interested in local news in those regions. However, I hope they will rectify and allow access again for EU users at some point soon. It seems to go against the idea of a borderless internet, and I blame the companies for that, not the EU.

_Codemonkeyism 8y ago
They will, see my click through EULA comment.
sschueller 8y ago
Too bad that they would actually have to block EU citizens not territories.
- baq 8y ago
  They're trying and it's quite effective. If they're fined (unlikely), their fine will most likely be greatly reduced.
dorfsmay 8y ago
> clear signal they don't care Or, it could mean they hadn't realised how much work it'd take to be GDPR compliant, and decided to temporarily use geographical blocking until they can be compliant.
- AJRF 8y ago
  It took them 2 years to realise that? That’s the same as not caring.
  - dorfsmay 8y ago
    When you have competing priorities and finite time and budget, people often don't investigate external requirements, assuming that they'll just comply when they no longer have a choice. That's why the first few audits (SOX, PCI, etc...) for a company new to them, are always such a struggle, people starting to look at the months of work needed the same week the auditors are planned to come in. edit/PS: Did you notice how many "We changed our policy" emails you've received in the past 2 weeks, including from very large international companies like google, yahoo, etc... Companies for which not being open for business in Europe would have financially impact. Probably a good indication that they ended up with a lot more work to comply that they had anticipated, and still made it just in time. Now imagine the same situation in smaller companies running on very thin resources that cannot afford a sudden increase in staff!

firic 8y ago

Things like this will test how much EU citizens value their privacy. Of course there will be some sites they will not be able to visit but time will show if they are okay with that. These rules are very similar to rules limiting loans. No matter how desperate a person is and how low credit they have, in the US you can't give them a loan for above a certain amount of interest. That could be terrible for a poor person who is about to be evicted if they don't get some money right away. But we as a society are willing to accept that if the result is that more loans will be "reasonable". If GDPR is enforced as HN people say it will be (in a good way) then the result will probably be that a lot of free websites ban EU users and smaller companies take their place with products that either cost money or will be a bit worse. If it enforced in a bad way then big companies who can navigate the law will get bigger because their small competitors will be to afraid of the law and shut EU users out.

imdutch 8y ago
You can still run a free website and be compliant with the GDPR. The EU/EEA is the largest market in the world, closing yourself for an market that size will hurt more than changing a few thing to be compliant.
- ghaff 8y ago
  >closing yourself for an market that size will hurt more than changing a few thing to be compliant Only if I make significant money from that market. If most of my revenue/profit comes from the US and it's problematic to "do business" in the EU or China, why wouldn't I want to just cut access off rather than dealing with potential hassles? The fact that it's potentially a large market is irrelevant to me. In this case, any moderately tech-savvy consumers can get to my site anyway using a VPN. But I've sent a clear message that I'm not marketing to European consumers.
  - akie 8y ago
    Well, you could! We’d be happy for you to make some space for a competitor who doesn’t make his money selling personal data.

adders 8y ago

The response to GDPR is interesting. If they are handling and selling your data in ways that are not compatible with GDPR, then you should seriously consider using someone else for that information.

kasey_junk 8y ago
Essentially every publisher that integrates with google might be out of compliance with the GDPR. Until that gets sorted out lots of sites are going to start doing this out of desperation.
- jonbarker 8y ago
  That and the facebook pixel.
lajhsdfkl 8y ago
> If they are handling and selling your data in ways that are not compatible with GDPR Very few businesses actually sell data the way you are imagining and if all GDPR did was ban that business model I would be happy with the existence of GDPR. GDPR is much more than that and this insinuation that every business that doesn't want to deal with this hassle is somehow evil and selling ultra detailed profiles on you to the highest bidder is highly mistaken.
- throwaway974 8y ago
  Yes, exactly. Sorry, I've been pasting this in multiple GDPR related threads, but just want people to get a concrete example of this. Here it goes: I have a profitable, bootstrapped SaaS business. It's not based on ads or selling data. I don't even have a freemium plan. Only a limited free trial after which you have to start paying. It's a trivial application that stores mostly already public data. Only email is required to login so that I can send password reset and other such communication. I've been talking to a very well known giant corporation for months. The VP and director love my product and want to start using it right away for their department. But their legal team is scared shitless with 4% fines in GDPR. They are putting some draconian clauses, (various ISO certifications and such) in the contract that I, as a small company, cannot comply. That's their interpretation of GDPR. It doesn't matter whether it's right or wrong. The VP and Director are really nice people and I've developed very good rapport with them. But I'm afraid their patience will run out soon and they'll go back to using spreadsheets. A lose-lose situation. This is the side-effect of GDPR. I'm all up for GDPR. I have uBlock, have blackholed all Facebook domains, etc. But don't assume that GDPR doesn't affect normal business transactions. Anyone who says, "Oh, how hard could it be?" has no idea what they are talking about.

_Codemonkeyism 8y ago

In 1y every website will have a click through EULA with 20 pages that loads before everything else and doesn't store IPS - and which no one is reading - privacy served. Just when they install from the App store or install Microsoft Office.

akie 8y ago
"Click here to agree to everything we do" schemes are explicitly forbidden by the GDPR. You need to individually opt-in to every single use case, and you need to consent to every transfer to each individual third party as well.
- _Codemonkeyism 8y ago
  IANAL No, coupling is forbidden. A 20 page, non-legalese EULA is allowed if you don't couple acceptance to using your site. "You need to individually opt-in to every single use case" No. But I would be happy for your source on that. You can't change the usage purpose after collecting, but if you declare what you do before (20 pages EULA) data collection, you're fine. "and you need to consent to every transfer to each individual third party as well." Yes, foggy data privacy declaration from the past are no longer allowed, but 20 pages EULA, 10 pages with company listings you transfer data to are. I'd also add a teaser on top with the most important things, like here https://juro.com/#privacy-popup https://juro.com/#privacy-popup If Paypal can do it, so can you.
  - vntok 8y ago
    http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&from=EN http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... > Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided. > Where processing is based on the data subject's consent, the controller should be able to demonstrate that the data subject has given consent to the processing operation. In particular in the context of a written declaration on another matter, safeguards should ensure that the data subject is aware of the fact that and the extent to which consent is given. In accordance with Council Directive 93/13/EEC (1) a declaration of consent preformulated by the controller should be provided in an intelligible and easily accessible form, using clear and plain language and it should not contain unfair terms. For consent to be informed, the data subject should be aware at least of the identity of the controller and the purposes of the processing for which the personal data are intended. Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. > In order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation. Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.

_Codemonkeyism 8y ago

In 1y every website will have a click through EULA with 20 pages that loads before everything else and doesn't store IPs - and which no one is reading - privacy served. Just when they install from the App store or install Microsoft Office.

addicted 8y ago
Except that won’t help them with the GDPR one bit. They will worsen their experience and not be in compliance because they are unwilling to actually do the simple things needed.
- _Codemonkeyism 8y ago
  IANAL but after working on GDPR topics for months with a lot of reading I'd say they would work. Selling data is still hard to argue, I'd not do that for EU citizens ("tag EU citizens to opt out from selling data"). Everything else should be possible. Using Art 6/1(a) and Art. 7 GDPR you can store most of the data from your visitor. You need to make sure they can inform them about your usage, revoke their aggreement and make you delete it. Coupling ("click EULA or else") is a little bit more difficult, but with clever UI most visitors will accept the EULA instead of opting out, no coupling needed. I'm sure in 1y publishing systems will provide all of this out of the box.
  - vntok 8y ago
    "Clever UI" (read: deceptive) tricks are obviously explicitely forbidden by the GDPR.
    - _Codemonkeyism 8y ago
      No, not a dark pattern, like LinkedIn, just a "yes" & "no", but if you place "yes" to the right side people will more likely click on "yes". If you space them at the bottom of the EULA, "no" to the left border, "yes" to the right border more people will click on "yes". This is not something I would do, but my salary is not coming from placing ads on a site and selling personal data. But this is what will happen.

Beltiras 8y ago

GDPR does not have the full force of law in Iceland but yet I am blocked. Not that I will miss those publications.

werid 8y ago
That's so strange, in Norway, I can still load LA Times.
- deleted 8y ago
  [deleted]

nhebb 8y ago

I wouldn't be at all surprised if they were caught off guard on GPDR. There are some who seem to feel that the pending deadline was universal knowledge, but I don't think it was for many of us in the US. I hadn't heard of it until the recent Monal kerfuffle here on HN.

abcd_f 8y ago

What else can they do when they have this laundry list of tracking scripts on a front page: https://i.imgur.com/hKEItPS.png https://i.imgur.com/hKEItPS.png They obviously have NO idea what's being collected on every user and how it is being used.

hartator 8y ago
That’s the whole point of GDPR, selectively kill the web businesses they want. BBC will never be concerned.
- yulaow 8y ago
  If those businesses are heavy shadow tracking/ads companies which don't even know which user data are they collecting, to who are they sending them and for which final use, man, I am so damn happy.
  - kodablah 8y ago
    This reads to me like a warmonger justifying innocent casualties. Surely you don't believe this only takes out the bad do you?
    - kinsomo 8y ago
      > This reads to me like a warmonger justifying innocent casualties. Surely you don't believe this only takes out the bad do you? How would it take out GDPR compliant websites? It they're not complaint, they're not exactly "innocent."
      - kodablah 8y ago
        Because the risk and costs of compliance are borne by all, not just the non-compliant. I would hope that "but laws only affect the bad guys" or "if you're doing nothing wrong you have nothing to worry about" would no longer be reasonable arguments these days.

qilo 8y ago

If anyone curious to see those blocking messages for themselves, LA Times and Chicago Tribune redirect EU users to these respective URLs: http://www.tronc.com/gdpr/latimes.com/ http://www.tronc.com/gdpr/latimes.com/ and http://www.tronc.com/gdpr/chicagotribune.com/ http://www.tronc.com/gdpr/chicagotribune.com/

flohofwoe 8y ago

Alternatively there's this: https://eu.usatoday.com/ https://eu.usatoday.com/ No ads, no tracking, no cookies, not even Javascript. Just plain HTML+CSS and JPEG images. The whole front page is around 650 KByte, and by far most of this is in the image files. As a result the page looks very clean and loads very fast. This is what all news web sites should look like, not just for EU readers (although I fear that this is just a temporary solution until they've figured out that whole GDPR thing...

toolslive 8y ago
US users who want the same, lovely, experience can route via Europe (for now).
- casefields 8y ago
  I just did and it's such a fantastic user experience.
tzfld 8y ago
And how can be a business sustainable in this way?
- geerlingguy 8y ago
  People will actually visit the site... so they get traffic. They could then advertise to through more creative, less user-unfriendly ways (besides having giant ad networks that store tons of user data on each person, along with 20 different vendors’ trackers to make sure each department gets the same data about each user in a very slightly different way).
- mlthoughts2018 8y ago
  One way to think of it is that “a business” is not “a user tracking, ad targeting website.” Whatever the business is, it’s not equal to the website, which is just one means of distribution of information or content. If the business was so predicated on user tracking and selling that data or using it to target ads, I think GDPR (in spirit) is saying “that’s not a business” and requiring a greater form of transparency and informed consent before a website can inflict that on a (possibly unwitting) user. I’m not trying to say this point of view is right or wrong, just that I think there is a spirit here in the intention of GDPR to say “that’s not something we’ll allow to be called a business model.” (Obviously it doesn’t fully go that far, but it’s the idea.) It’s not that different in spirit than regulating usury or payday loan businesses. If your business model profitably works only because it preys on people, the spirit of the regulation is to say, “that’s not a business model,” and regulate or disallow it. Usury laws in the case of excessive short-term interest rates; GDPR in the case of excessive user tracking and data privacy concerns. So when you ask, “how can be a business sustainable in this way?” it sort of has the wrong premise. Instead, if the business could not be profitable without this then it wasn’t actually ever a business— rather it was some other data exploitation entity, and the lack of an alternate way to be profitable in compliance with GDPR is a signal that the entity was unable to determine a way to exist without causing the kinds of harm that GDPR aims to prevent. Again, I’m just trying to represent what I think the spirit is behind the GDPR choices— not saying they were right or wrong.

chatmasta 8y ago

I'm in the UK atm. I just took a look at CNN.com, and uBlock is still blocking dozens of trackers there. I disabled it to see if I would get a GDPR consent popup, but all I saw was an accept cookies notification, nothing about the dozens of third party trackers on the site, other than some sparse information. There is no way to opt out of them, and there is only an “I accept” option on the accept cookies box. So CNN is not GDPR compliant, even though they've been running stories about it recently?

Agathos 8y ago

Obligatory link to the original tronc vision: https://www.youtube.com/watch?v=OtwiWd1LTeg https://www.youtube.com/watch?v=OtwiWd1LTeg

miabiel 8y ago

What about EU citizens residing outside the EU? Banning visits from EU aren't avoiding the GDPR problem.

whyever 8y ago
I don't think they are protected outside the EU.
pluma 8y ago
The GDPR is about EU residents, not citizens. You don't need to be a EU citizen but you do need to be in the EU at the time.

ashelmire 8y ago

...and little of value was lost. American news sites are overwhelmingly filled with nonsense. But really, I’m surprised they even bother to block EU users. Not like the GPDR can really be enforced in the US.

zerostar07 8y ago

Well we still have HN, even if non-compliant.

jacquesm 8y ago
Why is HN non-compliant? They use Cloudflare which has gone out of their way to be compliant (to the point of offering US citizens and the rest of the world the same protections as EU citizens), and nothing else is included on the page that could track you (check it if you don't believe me). You can anonymize your profile, you can edit it and you can use one of several services to get your data out. On the whole it is pretty good.
- dmitriid 8y ago
  > Why is HN non-compliant? > They use Cloudflare Just the fact that you use some GDPR-compliant service doesn't mean that your product is GDPR-compliant. Because your product has to make sure that it stores, processes, removes, rotates etc. personally-identifiable data in a GDPR-compliant way. E.g. HN doesn't offer a way to request the data they have on me, or to delete my account. This is not GDPR-compliant.
  - adrianmsmith 8y ago
    It only "doesn't offer a way" if you write an email to HN and they refuse to do it, or don't answer. I haven't requested that myself, so I don't know what answer you'd get. But I think, unless there's evidence that someone's got such an answer from them, it would be wrong to assume they won't/can't do it. Deleting data etc. doesn't have to be automated i.e. with a button to do it. Writing to them and them doing it is sufficient.
    - jacquesm 8y ago
      Spot on. That's exactly how it is. It would be nice if the GDPR mandated automated procedures for all of the above that are no more complex than it is to sign up and post in the first place. But that's not quite how it works. There are such requirements in some of our laws with respect to signing up and cancelling paid services.

mrfusion 8y ago

Is blocking a legal way to comply with gdpr? Surely you can’t identify all Eu-ians? Does the law just care that you made an effort to block them?

Sargos 8y ago
Yes. Intent matters. The website is showing that they do not want EU visitors as they don't want to deal with the high cost of GDPR. If an EU visitor manages to bypass this restriction in some way like a VPN then they lose their EU protection as they are hiding their identity as a EU citizen.

throwawaymanbot 8y ago

Its almost like they didn't try, due to making so much money selling user data. And blocking EU users is a childish attempt at protest. Places that DID respect user data to begin with have not had to do this. Which makes me actually wonder what horrors are going on with data we dont know about.

millette 8y ago

From Canada, http://www.thesuburban.com/ http://www.thesuburban.com/ too is unavailable in Europe due to GDPR.

TorKlingberg 8y ago

I am worried regulations will make the Internet more geographically fragmented. The best thing about the Internet is how it captures the long tail. A random person in Slovenia can read a local news site in Kansas if they wish. Even if spending just one minute of effort making itself available in Slovenia would be a loss for said news site. The Internet is by default global and everything is available to everyone. It takes extra effort to block regions, but I'm afraid regulations will make people spend that extra effort.

adventured 8y ago
There's no scenario where the 'open' Internet doesn't rip apart. Globally there will be dozens of GDPR type regulations, and that's just covering privacy. There will be a lot more for economic rules, cultural rules (eg governing speech), etc. Want to operate a service in 100+ countries? You'll have to comply with thousands of rules. Only giant companies will be able to do it. It's already extremely difficult to do. In the physical goods world, generally only very large companies can operate in 100+ countries; that's exactly how it will be for Internet companies in the near future. In the case of the US, there will be an immense advantage for tech services & sites. I can make a lot of money on ads just in the single large US market, far more than necessary to support a global operation. I can then project out into the rest of the world, without concern for complying with everyone's individual rules (unless it makes economic sense). For those localities to stop me, they all have to implement draconian Chinese-style repression of their people and what they can see online (which most will not do).
- lajhsdfkl 8y ago
  I really think the EU guaranteed US tech dominance with this law. How many months of work did the EU just add to getting out an MVP? How are EU startups even going to do AB testing to improve their product without collecting user data?
  - M2Ys4U 8y ago
    I suggest you actually read the GDPR (for legislation it's actually quite readable) before spouting off nonsense like this. >How many months of work did the EU just add to getting out an MVP? None. >How are EU startups even going to do AB testing to improve their product without collecting user data? The same way they always have.

tomatotomato37 8y ago

Explain to me again how this won't functionally turn into the EU version of FOSTA?

tracker1 8y ago

Honest hypothetical question... my website is in the US, my servers in the US, why would I care about the GDPR?

orwin 8y ago
if you don't deal with EU customers (like if you don't sell ads to EU advertisers), you don't have to.
CodeSheikh 8y ago
Does your website serve users from EU region or do you intend to block incoming traffic form EU? If you serve them then you might want to collect some data points about them. It is like being on the internet you are by default given a chance to operate business (website in this case) in whatever country a user access your website from. You are not going to open a franchise in Germany and not abide by their local laws concerning about German shoppers right?
- ryanwaggoner 8y ago
  This is an insane argument. So now by having a blog, I’m under the jurisdiction of 200 countries and countless other small jurisdictions? What happens when they all contradict each other? Or when I can’t tell what jurisdiction a user belongs to? Or when they pass crazy laws like anti-blasphemy or demand half my revenue, or whatever? I don’t think you’ve thought this through.
  - buckminster 8y ago
    > So now by having a blog, I’m under the jurisdiction of 200 countries and countless other small jurisdictions? Guess what? You already are. For example, if you insult the Thai king on your blog and you visit Thailand you can be prosecuted. This has happened. Of course, you can't be extradited for this. But if you are a notorious online controversialist you should be careful where you travel.
    - 8y ago

yeeeeeeeeee 8y ago

Regardless of GDPR, this is good in the short term. Organizations can comply with regulations (and ostensibly reduce market failures) or not comply and lose market share. If all regulations fell into the former camp we haven't tried enough strict regulations. More generally I think a big problem with compliance is 1) Current business model practices. We don't know how all the ways to make money on the Internet because it hasn't been around that long so we just sell data/ads. 2) Technical limitations. The Internet is organized around centralized systems but this doesn't have to be the case. It's just hard to build a comparable decentralized system easily with the current tools.

fredley 8y ago
I agree with this, and hope that it will cause innovation on both points. I know there are a lot of regulation-phobes on here, but good regulation is a driver of (good) innovation, as opposed to further innovation in fields like spying on customers and exfiltrating as much data on them as possible. Innovation will always be made, and I feel that currently, many great minds are being utilised to make people click on ads. Hopefully this is a step towards changing that.

awat 8y ago

On one hand I can understand why some orgs are having trouble with GDPR. On the other hand it’s pretty clear the actions of more than a few have gotten GDPR to where it is. My takeaway at the moment is something along the lines of this is why we can’t have nice things.

dominotw 8y ago
I attribute it to European jealously over american tech success. Hi tech success that flies in the face of their supposed social, cultural and moral superiority. User tracking is not really why we don't have nice things, look at the success of moviepass even after they publicly admitted what they were tracking. People want part of the spoils which is exactly the purpose of GDPR.
- gcthomas 8y ago
  Isn't Moviepass hæmmoraging $20 million a day while its share price tanks? No, if you knew how Europeans think, you'd realise that this is really just about securing privacy. Most of the regulators are really focussed on ensuring compliance, not levying fines.
  - getsugablitz2 8y ago
    They're losing $20 million a month, if they were losing that per day that'd really be something. Probably would be out of business in a few weeks.
  - dominotw 8y ago
    > Isn't Moviepass hæmmoraging $20 million a day while its share price tanks? Correct me if I am wrong. But that just proves my point rather than yours, correct? They are losing so much from ppl using not because ppl are quitting it due to privacy concerns.
    - gcthomas 8y ago
      They are losing money because they have an unsustainable pricing model. Other cinema services were saying Movie pass would fail as soon as they started.

OrganicMSG 8y ago

Technically, this would seem true for a lot of things.

deleted 8y ago

[deleted]

Yabood 8y ago

There are so many wrong things with this approach. First, what do you do when you have existing users, delete them? Second, I believe the law protects EU citizens regardless of where they are. If you're an EU citizen and register for a service somewhere in the US using VPN or while physically being outside the EU, that service/company will still need to comply. The safest approach is to comply. We're a tiny startup, but we decided to bite the bullet and comply because its much easier and quite frankly better for all in the long run. Oh and, disclosure sets you free.

adventured 8y ago
> Second, I believe the law protects EU citizens regardless of where they are. That's incorrect. That is the attempted naive reach of the EU in action. The correct formulation is: the EU would like for GDPR to apply to all EU citizen data globally. US sites/services with no business reach into the EU, do not need to comply with EU privacy laws. 99% of businesses around the world (most small businesses), those outside of the EU, will entirely disregard GDPR - because they have no business dealings with the EU. The EU has no jurisdiction over the US economy or its laws. That will remain the case. The EU also doesn't control China, or India, or Japan, or Brazil, or South Africa. A simple example for illustration: I can establish a new US service that is ad based (with eg 100% of revenue being derived from the US market), I can keep all of my infrastructure & business operations outside of the EU, I can take on EU users at will, and I can do anything I want to - in compliance with US law - with their information without concern for GDPR: because the EU does not lord over the US, their laws do not rule the US. This is legally how GDPR actually works, despite the amusing propaganda campaign to pretend GDPR requires global compliance.
- gcthomas 8y ago
  Only until the TTIP treaty gets finalised! Then there may be a mechanism for some comeback.
- strictnein 8y ago
  > the EU does not lord over the US, their laws do not rule the US. This is legally how GDPR actually works The number of people who have lost sight of this is unbelievable. It actually seems especially rampant on HN, which is kind of surprising, to be honest.

mrmekon 8y ago

I'm in the EU, and a couple of the corporate VPNs I have used here have had their exit IP in the U.S. or Canada. Which means that when I'm at work, I appear to be in Seattle, and these sites are not blocked. Based just on that, I'd argue that "Blocking 500M Users Easier Than Complying with GDPR" is probably not even a true statement. I doubt EU regulators will go after these sites because they really aren't that consequential, but I wonder if setting up an IP block isn't just painting a target on yourself. It's basically a statement that the company was and still is violating GDPR.

ryanwaggoner 8y ago
What exactly do you want here? Do you want every site to have you upload your passport? Or are you just saying that any jurisdiction in the world should be able to effectively force every company globally to comply with their laws, and that they can’t pull out of those markets if they find the law too onerous? Forget about the intent of the GDPR, what about the broader principle when applied to laws you don’t like? What if the US passes the anti-GDPR next week, that you MUST track all available data for US residents or citizens, no matter where in the world they are? What then?
- mrmekon 8y ago
  My comment doesn't make a statement about how things should be. It's a statement about the complexities of a technical implementation: _If_ it is true that the GDPR covers an EU person's data held by any company worldwide, regardless of how or whether it should, an IP block might not be accepted as compliance. Or it might, if the EU regulators decide that best-effort is enough. The important point is that many Europeans are browsing the net through non-EU IP addresses without the knowledge that they are doing so. Most people do not pay attention to what their corporate public IP address is. They may use "non-EU" services entirely unintentionally, and EU regulators may or may not take that into account in the unlikely case that they investigate one of these companies.
  - sb8244 8y ago
    I am curious how this will play out. I am not sure how else EU regulators could play it out without essentially saying that all users must identify themselves honestly to a site. What happens if a person marks their country of origin as US even if they aren't in the US and their IP isn't. They lie in that case, but are they still protected?

rdlecler1 8y ago

They claim that everyone had a lot of time, but what about the 1-3 person startup that’s been around for 4-5 years who is just getting by and didn’t have the resources to re-engineer their entire application or to write up a complex privacy policy or hire an EU Representative (Yes, apparently that is required as well). If the EU does clamp down on forced consent I think the long tail of small startups and publications and side projects will simply block EU visitors because they won’t have the means to become compliant. I’d be interested to hear how problematic this is for new startups who are building GDPR complianance into the systems from scratch. It would seem to amount to needed bespoke permissioning for every user because forced consent is not permitted (although being widely used).

cortesoft 8y ago
If your startup doesn’t have any business in the EU, they can’t go after you.
- oaiey 8y ago
  "Business" means website visit from a US/EU citizen travelling Europe. And even blocking them by IP and logging it is a violation. User can file a complaint against you, resulting in a ruling. Whether you ever see an "invoice" or see police officers is another topic. But you violate the regulation/law in another country.
  - majewsky 8y ago
    Blocking by IP is okay, logging it is the only violation. And why on earth would you have to log those blocks?
    - oaiey 8y ago
      That's right!
    - cortesoft 8y ago
      You would want to log it to make sure you aren't accidentally blocking the wrong people.

AndrewKemendo 8y ago

This seems 100% rational. If the sites determined that they cannot or will not show ads in compliance with GDPR, then why would they pay for the bandwidth it takes, knowing they can't monetize it without being in violation? It's the equivalent of the whole of the EU putting uBlock on their computers. Companies that make the majority of their money on advertising are responding.

kartan 8y ago

Business don't comply with regulations because it is easy, but because it's needed to do business. If a service didn't had a big user base in Europe, most countries don't speak English, it may be cheaper to remove the service. The New York Times or The New Yorker that even have physical copies available in Europe work as usual. I work in a gambling company and this is our day to day business. To enter a new market means to follow a new set of regulations. To do the adaptation or not is an strategic decision based in complexity, expected revenue and other factors. GDPR is just another regulation to add to the long list related to tax evasion, responsible gambling, fair play, etc.

rdlecler1 8y ago
Regulations tend to favor incumbents, decreasing competition, and thereby increase monopoly and creating central hubs of systemic risk. There is no free lunch with one-size-fits-all rule making. Unfortunately regulators think there is.
- fixermark 8y ago
  And when it comes to European business law in particular, there's no reason to believe favoring incumbents and decreasing competition isn't an intended benefit. When Amazon entered the French market, it tripped over laws putting a floor on discounts allowed that are intended to protect book sellers, not purchasers.
- hau 8y ago
  Can you back up such strong and broad claims with something?
  - baxtr 8y ago
    Not every claim on HN needs a backup. This one makes total sense to me. In this case, the article itself shows that regulation is definitely decreasing alternatives, which in turn can lead to monopolies
    - 8y ago

fiatjaf 8y ago

Shameless self-promoting an easy solution for your small site, if you too want to get rid of EU people: https://euroshield.xyz/ https://euroshield.xyz/

Double_a_92 8y ago

All those pages seem to block the entire continent not just the EU. I'm in Switzerland (not in EU) and still get blocked.

rdlecler1 8y ago

GDPR is significant because for the first time in this history of the Internet an (EU) user no longer has a marginal cost of zero. The cost to write an application to be GDPR compliant is high and frankly will not be worth it for many entepreurs developing an MVP.

fastball 8y ago
That's not true at all. It's really easy to build an MVP that complies with GDPR.
- rdlecler1 8y ago
  Really? Do you have an EU representative for your MVP? Did you hire a legal team to review your site and write up your terms of service? Send me your MVP and I’ll show you 10 thing a that are wrong with it and if you are complaint somehow then I doubt the product will be viable at all.
  - matwood 8y ago
    So my MVP is an imaginary service that does X for you. It charges $5/month and it uses your email as the log in. It captures no data other than what you give it to do said service. Other than good data practices which should be followed anyway, please described the huge GDPR hurdles that will make this service not viable.
    - ithkuil 8y ago
      Apparently you need to appoint a Data Protection Officier and you cannot just be e.g. CEO, developer and DPO at the same time. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-officers/ https://ico.org.uk/for-organisations/guide-to-the-general-da... > Basically this means the DPO cannot hold a position within your organisation that leads him or her to determine the purposes and the means of the processing of personal data Are there exemptions for very small companies? If you can prove you don't process any user data, at all, does this exempt you from having to appoint a DPO?

dmitriid 8y ago

""" USA Today stops tracking EU citizens. Americans/others are still fair game. When it comes to privacy, Americans are now formally 2nd-class world citizens. """ https://mobile.twitter.com/aral/status/1000005956493770753 https://mobile.twitter.com/aral/status/1000005956493770753

rdiddly 8y ago

Europeans just found out which US sites were tracking and profiling them.

shadowtree 8y ago

Well - what does this mean for US citizens then? If those site violate GDPR laws, what exactly are they doing with user data, how are they securing it? Do they even know what's going on? Good litmus test for privacy/info sec readiness in corporations.

ryanwaggoner 8y ago

I hope we get a LOT more of this. If the EU wants to pass laws that say every company around the world (almost all of which have ZERO democratic representation in EU government) has to fully comply or face huge fines that will drive them out of business, let’s see how they feel when all those companies just shrug and turn their back on the market. I know the GDPR fans here will just say “good, we’re better off without them!” and I guess on that we agree. Go in peace.

mark_l_watson 8y ago
Hello Ryan (I like your business advice newsletter), honest question: In the USA we have FICA laws that can fine foreign banks, in foreign countries, not here, for most of a year’s income if they make a single error in reporting financial,records of US citizens. Most banks in foreign countries simply refuse US citizens as customers. How ae laws like FICA OK but not GPDR?
- ryanwaggoner 8y ago
  Thanks for the kind words re: newsletter :) Are you thinking of FATCA? I’m not an expert, but from what I can tell, I’m not a fan. I think telling US citizens that they have to report is fine, asking foreign banks to report is fine, and requiring foreign banks that also have a US presence to comply is fine. But if FATCA applies to some small community bank in Japan, then that’s ridiculous.

nominated1 8y ago

As a non EU member I'm jealous. I would love to see a uBlock filter list targeting all non GPDR compliant addresses. Maybe something like the 'Badware risks' list that allows you to proceed but not before displaying a warning.

natch 8y ago

Are there any publicly traded VPN providers?

WindowsFon4life 8y ago

s/news/propaganda

throwaway974 8y ago

I have a profitable, bootstrapped SaaS business. It's not based on ads or selling data. I don't even have a freemium plan. Only a limited free trial after which you have to start paying. I've been talking to a very well known giant corporation for months. The VP and director love my product and want to start using it right away. But their legal team is scared shitless with 4% fines in GDPR. They are putting some draconian clauses, (various ISO certifications and such) in the contract that I, as a small company, cannot comply. That's their interpretation of GDPR. It doesn't matter whether it's right or wrong. The VP and Director are really nice people and I've developed very good rapport with them. But I'm afraid their patience will run out soon and they'll go back to using spreadsheets. A lose-lose situation. This is the casualty of GDPR. I'm all up for GDPR. I have uBlock, have blackholed all Facebook domains, etc. But don't assume that GDPR doesn't affect normal business transactions. Anyone who thinks, "Oh, how hard could it be?" has no idea what they are talking about.

ams6110 8y ago

Facebook, Google, Instagram and WhatsApp are accused of forcing users to consent to targeted advertising to use the services. Privacy group noyb.eu, led by activist Max Schrems, said people were not being given a "free choice". I mean, that just isn't a valid complaint IMO. You have a choice -- you can not use Facebook, or not use Google, or not use Instagram, or not use WhatsApp. If you're using a "free" service that is ad-funded, why do you think you have a right to use it without consenting to the ads?

freeflight 8y ago
It is a very valid complaint and becomes even more valid as Facebook is scrutinized even further. Zuckerberg's EU hearing was a rather good indicator of where this is heading when MEP's specifically singled out: - Facebook's business practices in general, the MEP's do not believe that what Facebook is doing can be done in the same way while respecting users privacy. Thus they kept asking how Facebook is planning to monetize it's service in the future while respecting their user's data. - Having Facebook admit to its monopoly position in the EU by asking Zuckerberg for any Facebook competition he knows of, in the EU. There's also this whole issue with Facebook simply slurping up WhatsApp, and all its user's data, even tho WhatsApp users never consented to any of that. I made a point of never giving Facebook my mobile number, a point that's made completely irrelevant when Facebook just throws money around to get any data they want complete with some manufactured opt-out consent.
king_phil 8y ago
Then you don't understand the most fundamental thing about the GDPR: "Kopplungsverbot" (german privacy law had that for ages before GDPR). You can't force someone to consent to marketing because he wants to use your service. Everything that is not part of the core service needs consent that can be withdrawn at every time. The core service of facebook is access to the network, not that my data is processed to show me better advertising. The advertising is in facebook's interest, not mine. "But we make our revenue from ads" is not a valid explanation. If your service was "sign up to see better ads", then that would be your core business and no consent needed. Best thing ever happend.
- 8y ago

ryanwaggoner 8y ago

What if the US to passes a law that Americans are too fat and are no longer allowed to be sold gelato (they're allowed to buy gelato, but no longer allowed to be sold gelato), and then levy a multi-million dollar fine against every gelato shop in Italy where Americans visit on vacation. How is that different from the GDPR?

craigsmansion 8y ago
The difference is that one is an example of actual and well-thought out legislation in the EU which is generally welcomed by the people most affected by it: EU citizens. The other is a trumped up example by someone on whom the GDPR self-admittedly has hardly any bearing but who still insists on throwing a hissy fit because legislation is somehow un-american or something.
- ryanwaggoner 8y ago
  I disagree on "well thought out", but it doesn't really matter. I don't think that legislation is "un-american" or that the EU shouldn't have passed this law for its citizens. My issue is with the attempt to declare that it applies so broadly to organizations in other countries who have no connection to the EU except that EU visitors might come to their website. I'm going to assume you're intentionally not trying to understand the broader principle here, but just in case: Reposted from another comment: My primary argument is that the GDPR's attempt to regulate companies in other jurisdictions because EU citizens go INTO those jurisdictions and do business is a dangerous precedent. If there was an enforcement mechanism for all such laws, it implies that any business or individual anywhere in the world with a website should therefore have to comply with any laws from any jurisdiction that are similarly constructed. If my website says things about Islam that Saudi Arabia passes a law against, I should be fined. If my website disrespects the king of Thailand, I should be extradited for imprisonment. If I encourage NK citizens to revolt against their oppressive regime, I should end up in a labor camp. After all, those governments have a right to say that if I want to "do business in their jurisdiction", I must respect their laws, right? (To be clear, I'm not talking about enforcement of these kinds of laws, because all of those countries might do the above if given the chance. I'm talking about what I SHOULD do as a matter of morality or ethics or civic duty or whatever, or what my government should cooperate with those governments on, because it's just.) But the problem is that they're describing "doing business in their jurisdiction" as a citizen from their country (maybe even one who is currently visiting my country) going online and sending my server requests, data, and money. And apparently explicitly telling those citizens to please NOT do that, or blocking them, is not sufficient. The only way to make the majority of the EU users on HN happy is to comply. Why would that same logic not apply to all other kinds of laws?

textmode 8y ago

The limitations of internet technology means that any computer located in the EU, whether or not the user controlling it is in the EU, can enjoy the beneficial effects of the GDPR. (Those limitations and effects being in part that companies will attempt to distinguish EU natural or legal persons based on IP address.) The GDPR finally provides a legitimate, compelling rationale for users to employ longstanding methods of partially controlling the flow of their traffic through the internet, e.g. setting up a hosting account that uses servers located in the EU and using those computers to access www sites. An ssh account on a server located in the EU has gained new value. Accessing the www from a computer located in the EU has new advantages, thanks to the GDPR. To users who are aligned with the goals of the GDPR, it is possible that www sites located in the EU have become more appealing than those located outside the EU. How will EU news sites treat users from outside the EU? Is there a benefit to using EU news sites from outside the EU?

M2Ys4U 8y ago
>GDPR only applies to EU citizens. No, it doesn't. It applies to natural persons in the EU. Article 3 GDPR: --- Territorial scope 1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. 2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union. --- Note that the above does not reference citizenship.

TomAnthony 8y ago

(Reply to a deleted comment on the burden of compliance as a US business) If you truly do intend to take good care of your users’ data, then the goal should be to have you demonstrate that whilst making it as easy as possible for you to do so (without compromising the said care). I’m hoping that over the coming weeks and months the enforcement of GDPR and various court cases will add clarity and allow the development of improved guidelines for becoming compliant. If a random SaaS company that users emails for logins and communication with active customers could look at a simple 5 point check list which they could check though in a day then things would be better for everyone. Less burden for customers, wider services for users, and those firms that can see they could make a few small changes to become compliant would be more incentivised to do so.

muzani 8y ago

Can't break privacy laws if you don't have any customers.

Tomte 8y ago

We're so acclimated to having no choice that I was genuinely surprised when I clicked on "Do not accept" at the http://politico.com http://politico.com web site and... nothing bad happened. I could read it as always. Clicking "Do not accept" made me nervous and feel somewhat rebellious.

notananthem 8y ago

Trib and Daily News are not journalism lol

t0mbstone 8y ago

Can someone explain to me how the EU is planning on enforcing GDPR on US-based companies? And even with EU companies, without some kind of third party auditing, how can you actually believe anyone's privacy policies which claim to conform? What's actually preventing everyone from just claiming that they are following it, and then secretly breaking the rules?