11 ms·

Things like this will test how much EU citizens value their privacy. Of course there will be some sites they will not be able to visit but time will show if the

by firic 8y ago

Things like this will test how much EU citizens value their privacy. Of course there will be some sites they will not be able to visit but time will show if they are okay with that. These rules are very similar to rules limiting loans. No matter how desperate a person is and how low credit they have, in the US you can't give them a loan for above a certain amount of interest. That could be terrible for a poor person who is about to be evicted if they don't get some money right away. But we as a society are willing to accept that if the result is that more loans will be "reasonable". If GDPR is enforced as HN people say it will be (in a good way) then the result will probably be that a lot of free websites ban EU users and smaller companies take their place with products that either cost money or will be a bit worse. If it enforced in a bad way then big companies who can navigate the law will get bigger because their small competitors will be to afraid of the law and shut EU users out.

imdutch 8y ago
You can still run a free website and be compliant with the GDPR. The EU/EEA is the largest market in the world, closing yourself for an market that size will hurt more than changing a few thing to be compliant.
- ghaff 8y ago
  >closing yourself for an market that size will hurt more than changing a few thing to be compliant Only if I make significant money from that market. If most of my revenue/profit comes from the US and it's problematic to "do business" in the EU or China, why wouldn't I want to just cut access off rather than dealing with potential hassles? The fact that it's potentially a large market is irrelevant to me. In this case, any moderately tech-savvy consumers can get to my site anyway using a VPN. But I've sent a clear message that I'm not marketing to European consumers.
  - akie 8y ago
    Well, you could! We’d be happy for you to make some space for a competitor who doesn’t make his money selling personal data.
  - IshKebab 8y ago
    They could still make some money from showing non-tracking ads to European users and tracking ads to American ones. Perhaps not as much, but as they have already written the content I don't see why you would just give up on that revenue stream.
    - ghaff 8y ago
      The point is that, if I'm not making material money from EU residents today, it may be easier for me to just make it clear that I'm not trying to do business in the EU than figuring out if I need to do anything to become compliant. I may in fact be 100% compliant, but it may take effort to figure that out and there's potentially still some risk. Personally, I do no tracking on my sites so it's irrelevant to me but I understand why news sites with primarily local readership would decide dealing with the EU is more trouble than it's worth.
      - mlthoughts2018 8y ago
        This could definitely happen, but would not make sense for the Chicago Tribune and LA Times, which are big corporate entities united as subsidiaries of Tronc, Inc., and could even pool resources to have one compliance office among them from the parent company. For a large, well-capitalized company to make this choice, it’s an indication of a few possibilities: - Tronc doesn’t practice anything close to adequate IT practices to even know its compliance status, and pefers not to invest in doing so. - Tronc can’t remain profitable if displaying GDPR-compliant pages in EU (this seems fleetingly unlikely, given the specific attempts to grow digital subscribership by marketing the papers as more global). - Tronc is trying to make a political statement, like a boycott, hoping that many companies do this and it puts pressure on mitigating GDPR. So while I agree with you for some small businesses just not wanting to mess with GDPR compliance or risks, however small, it certainly isn’t aviable explanation for these newspapers.
        JackFaker 8y ago
        It's likely that it's just side effect of months of institutional paralysis. The Chairman of Tronc stepped down earlier this year after allegations of misconduct and I believe they were negotiating the sale of the LA Times to an investor and the rest of the company to Softbank.
  - mrtksn 8y ago
    When you don't a competitor steps in and if the day comes that you want some EU sales, you will have to spend huge sums to establish your brand if you are not a huge brand that's on TV shows and the News all the time. Geo-locked products are nothing new. I lived in a communist country, few EU countries and a middle eastern country and I can promise you that when a certain brand is not available a local competitor pops up and after the original brand becomes available it stays remain a curiosity unless it's a massive pop culture icon(McDonald's, CocaCola, Amazon, Netflix etc. - stuff that's on American TV shows all time. The TV Shows are also geo-locked but local pirates make them available few hours after the USA. Even in Cuba). So, it's not a simple problem of if(profit < feel like worth it) then block EU.
  - roel_v 8y ago
    I see this 'VPN' argument a lot, but it's wrong. If the Chicago Tribune tracks users accessing their site through a VPN, without informed consent, they are in violation. Art 3 para 2 in b makes the Regulation apply to them and doesn't make provisions about whether the controller or processor has a way to find out if the behaviour of the data subject takes place within the Union. I don't see any reason for a different interpretation in the Recitals, either. Furthermore note that subs a and b in art 3 para 2 are alternative, not cumulative requirements. Let me rephrase: when you collect data on people with the goal to do behavioral / preference analysis on it, it doesn't matter any more whether or not you're 'marketing' to them, or even that you 'send them a clear message' you don't 'market to them'. The GDPR still applies to you.
    - philipov 8y ago
      So you're saying that if I block my site to EU IPs, and someone uses a VPN to look like they're coming from the US and bypass that, they can then sue me under the GDPR? No way.
      - roel_v 8y ago
        No, they can't 'sue' you; they can make a complaint to their data authority who will then decide if and what to do about it. So if your site blocks EU IPs and you then violate the privacy of someone in the EU grossly enough to warrant the data authority to make a case out of it, then yes. (provided everything else also applies, e.g. the things being talked about in the rest of this thread).
        rblatz 8y ago
        Put it in your TOS that European users are forbidden from using your site, and then if they complain to a data authority press charges under the CFAA, and sue them for damages you incurred due to their violation. Then let the courts hash it out.
        roel_v 8y ago
  - kinsomo 8y ago
    > Only if I make significant money from that market. If most of my revenue/profit comes from the US and it's problematic to "do business" in the EU or China, why wouldn't I want to just cut access off rather than dealing with potential hassles? Because you would rather grow your market?
    - eyeinthepyramid 8y ago
      There are 6.5 billion non-Europeans, there's plenty of market outside of Europe.
      - kinsomo 8y ago
        > There are 6.5 billion non-Europeans, there's plenty of market outside of Europe. The world doesn't have uniform GDP per capita. Potential European customers have more money to spend than most of those other potential customers. If you're looking for a new market, Europe is a juicy one.
    - taysic 8y ago
      If you run a free website that depends on targeted ads to make money, you might want to expand to the EU but now you'd need to totally change your business model to do so. For some that would basically mean inventing a new company because their service is not the type people would pay for. So in this case, it may not be worth it.
  - jenscow 8y ago
    > But I've sent a clear message that I'm not marketing to European consumers. More like, sent a clear message you're not concerned of your user's data. (Nothing personal, the signal may not necessarily echo the reality)
- rdlecler1 8y ago
  False. The marginal cost of an EU customer is no longer zero. Why should I put in a bunch of work for GDPR compliance if the cost to implement it exceeds the initial marginal cost of an EU user. There is still the rest of the world.
  - malka 8y ago
    Good. if you do not value my privacy, I dont want you to do business here. another product will replace your own. And in all likeness an EU one, meaning less euros leaving the eurozone. I'm all for it.
    - ryanwaggoner 8y ago
      if you do not value my privacy False equivalence. You can do nothing untoward with user data and still not be compliant.
      - jimmaswell 8y ago
        Exactly. The most basic/outrageous example: anyone in the EU who installs Apache and leaves it in its default configuration which logs all page visits indefinitely is now a criminal. Spin up a DO/Linode/etc. instance and apt-get install apache2? You're now theoretically liable for a 20 million Euro fine.
        openIce 8y ago
        This is the most retarded comment I have read today. Literally everything you say is false
        jimmaswell 8y ago
        Are you disputing that GDPR disallows you from retaining visitor IPs, especially without explicit consent?
        8y ago
- dageshi 8y ago
  Launch in the rest of the world first, if you're successful then think about the EU. Seems like the way to go.
- ww520 8y ago
  If I run a free website, I have 0 revenue. Why would I care how big the EU market is?
- reaperducer 8y ago
  * The EU/EEA is the largest market in the world* Define "largest" in this context.
  - reaperducer 8y ago
    Nevermind. I looked it up. The European Union is 7% of the world's population. So by "largest" he means "not largest," as in there's still 93% of the world left to do business with.
- lajhsdfkl 8y ago
  > The EU/EEA is the largest market in the world Please don't believe your own propaganda. EU/EEA revenue is a fraction of US revenue for all large multinationals. Small businesses probably make even less from the EU.
mrtksn 8y ago
So EU citizens will either revolt and destroy EU or read their news from somewhere else? More likely, will do the usual thing people do for geo-locked content: Use proxy or pirate until a convenient solution takes off. That convenient solution will be GDPR compliance by the offender or a competitor. I mean, mild annoyance is nothing compared to the annoyance of war thorn continent, I wouldn't bet too much on the destruction of EU or even withdrawal of GDPR
- kodablah 8y ago
  > So EU citizens will either revolt and destroy EU or read their news from somewhere else? Those are the only two options? Now that I know that, instead of what a practical person might deem as an option which is to repeal the law, the EU and GDPR proponents' mindsets make a lot more sense. I often wondered why new legislation was piled on older legislation that wasn't even enforced then, and why other statues wrt cookies and what not cannot be seen by legislators as more bad than good and worth removing. Now I know.
  - mrtksn 8y ago
    My next sentence is literally a third option, describing what happens with geo-blocked content.
    - kodablah 8y ago
      And that it isn't even an option to recognize a bad law and repeal it, even if it had good intentions, speaks volumes.
      - mrtksn 8y ago
        As an EU citizen, I don't think the law is bad but you are free to be upset about it, of course. Please respect our laws and privacy or don't do business with us. We will be very sorry if your product is irreplaceable or we will use a competing product that complies with GDPR.
voidr 8y ago
> the result will probably be that a lot of free websites ban EU users Good riddance, at least we know what websites we shouldn't have visited in the first place. > smaller companies take their place with products that either cost money or will be a bit worse. Or they will be better and still be free. News companies are dying, news is commodity, if I can't read something on the LA times, I'm sure I'll find that same article on some other news site. > small competitors will be to afraid of the law and shut EU users out It's not a complicated piece of legislation, the short version is this simple: only collect data you actually need on your user to offer your service and be prepared to explain why, that's basically it. > But we as a society are willing to accept that if the result is that more loans will be "reasonable". The actual reason is that if you don't limit the loans, your economy will collapse.
- ghaff 8y ago
  >News companies are dying, news is commodity, if I can't read something on the LA times, I'm sure I'll find that same article on some other news site. Or the original news simply ceases to exist as is already happening at the local level in many cases. There's probably a continuing market for some global news organizations that are at least muddling through with subscriptions and other products. (Or not. See story on Time Inc. recently.) But I suspect the non-national/international journalism will continue to decline.
- rdlecler1 8y ago
  You assume that just because someone doesn’t want to got through all the hassle of being GDPR compliant that the website is somehow bad? Among other things this includes setting up an EU represeneitive—a high bar for a free product..... Obviously you haven’t had to deal with GDPR compliance.
  - voidr 8y ago
    > You assume that just because someone doesn’t want to got through all the hassle of being GDPR compliant that the website is somehow bad? If they are not collecting any personal data, there is no hassle. Do you think it's somehow bad for a car manufacturer to not want to go through the hassle of making their cars conform to the safety standards? > Among other things this includes setting up an EU represeneitive Citation needed. > a high bar for a free product The product is not really free because users pay for it with their data, which was unclear before. > Obviously you haven’t had to deal with GDPR compliance. Obviously from what? Are you a GDPR compliance expert?
gutnor 8y ago
> then the result will probably be that a lot of free websites ban EU users and smaller companies take their place with products that either cost money or will be a bit worse. Availability of quality free content is not a problem, the content will just be available from other source. The big problem on the ads-monetized web today is ranking high enough, and the site that don't want to apply GDPR will just have to compete with the site that do have the extra push the EU market give them. On the advertizer side, they make direct money from content accessibility so they will upgrade their tracker so it is GDPR compliant for EU-traffic with no work from the content publisher. That is a non issue, this is just day one of a big change. Let's also not paint a rosy picture of the web either. GEO blocking is a common daily reality for people outside the US. Any valuable and popular content is locked already, despite being monetized quite directly (see Netflix, Amazon Prime, ...)
- reaperducer 8y ago
  >Availability of quality free content is not a problem Only if all content on every web site around the world is equal. Which it is not. If the quality was the same everywhere, and the same content was available everywhere, then people in Europe wouldn't have to go to web sites in other countries. There are lots of reasons for companies in Europe to need to read the Chicago Tribune (PR clipping service, for example). But the Tribune's content is no longer available to the E.U., and will not be replicated elsewhere for copyright reasons. As much as I dislike Tronc as an entity, I don't blame it for this decision. Within hours of GDPR going into effect, the lawsuits started flying. That's exactly why some companies decided it was easier to just opt out of Europe.
- taysic 8y ago
  The question is - the sites that serve massive amount of content (images, videos, etc) - will they be able to cover their costs in the EU without making their apps paid? What about currently free games which rely on personalized ads?

by firic 8y ago

imdutch 8y ago

You can still run a free website and be compliant with the GDPR. The EU/EEA is the largest market in the world, closing yourself for an market that size will hurt more than changing a few thing to be compliant.

ghaff 8y ago
>closing yourself for an market that size will hurt more than changing a few thing to be compliant Only if I make significant money from that market. If most of my revenue/profit comes from the US and it's problematic to "do business" in the EU or China, why wouldn't I want to just cut access off rather than dealing with potential hassles? The fact that it's potentially a large market is irrelevant to me. In this case, any moderately tech-savvy consumers can get to my site anyway using a VPN. But I've sent a clear message that I'm not marketing to European consumers.
- akie 8y ago
  Well, you could! We’d be happy for you to make some space for a competitor who doesn’t make his money selling personal data.
- IshKebab 8y ago
  They could still make some money from showing non-tracking ads to European users and tracking ads to American ones. Perhaps not as much, but as they have already written the content I don't see why you would just give up on that revenue stream.
  - ghaff 8y ago
    The point is that, if I'm not making material money from EU residents today, it may be easier for me to just make it clear that I'm not trying to do business in the EU than figuring out if I need to do anything to become compliant. I may in fact be 100% compliant, but it may take effort to figure that out and there's potentially still some risk. Personally, I do no tracking on my sites so it's irrelevant to me but I understand why news sites with primarily local readership would decide dealing with the EU is more trouble than it's worth.
    - mlthoughts2018 8y ago
      This could definitely happen, but would not make sense for the Chicago Tribune and LA Times, which are big corporate entities united as subsidiaries of Tronc, Inc., and could even pool resources to have one compliance office among them from the parent company. For a large, well-capitalized company to make this choice, it’s an indication of a few possibilities: - Tronc doesn’t practice anything close to adequate IT practices to even know its compliance status, and pefers not to invest in doing so. - Tronc can’t remain profitable if displaying GDPR-compliant pages in EU (this seems fleetingly unlikely, given the specific attempts to grow digital subscribership by marketing the papers as more global). - Tronc is trying to make a political statement, like a boycott, hoping that many companies do this and it puts pressure on mitigating GDPR. So while I agree with you for some small businesses just not wanting to mess with GDPR compliance or risks, however small, it certainly isn’t aviable explanation for these newspapers.
      - JackFaker 8y ago
        It's likely that it's just side effect of months of institutional paralysis. The Chairman of Tronc stepped down earlier this year after allegations of misconduct and I believe they were negotiating the sale of the LA Times to an investor and the rest of the company to Softbank.
- mrtksn 8y ago
  When you don't a competitor steps in and if the day comes that you want some EU sales, you will have to spend huge sums to establish your brand if you are not a huge brand that's on TV shows and the News all the time. Geo-locked products are nothing new. I lived in a communist country, few EU countries and a middle eastern country and I can promise you that when a certain brand is not available a local competitor pops up and after the original brand becomes available it stays remain a curiosity unless it's a massive pop culture icon(McDonald's, CocaCola, Amazon, Netflix etc. - stuff that's on American TV shows all time. The TV Shows are also geo-locked but local pirates make them available few hours after the USA. Even in Cuba). So, it's not a simple problem of if(profit < feel like worth it) then block EU.
- roel_v 8y ago
  I see this 'VPN' argument a lot, but it's wrong. If the Chicago Tribune tracks users accessing their site through a VPN, without informed consent, they are in violation. Art 3 para 2 in b makes the Regulation apply to them and doesn't make provisions about whether the controller or processor has a way to find out if the behaviour of the data subject takes place within the Union. I don't see any reason for a different interpretation in the Recitals, either. Furthermore note that subs a and b in art 3 para 2 are alternative, not cumulative requirements. Let me rephrase: when you collect data on people with the goal to do behavioral / preference analysis on it, it doesn't matter any more whether or not you're 'marketing' to them, or even that you 'send them a clear message' you don't 'market to them'. The GDPR still applies to you.
  - philipov 8y ago
    So you're saying that if I block my site to EU IPs, and someone uses a VPN to look like they're coming from the US and bypass that, they can then sue me under the GDPR? No way.
    - roel_v 8y ago
      No, they can't 'sue' you; they can make a complaint to their data authority who will then decide if and what to do about it. So if your site blocks EU IPs and you then violate the privacy of someone in the EU grossly enough to warrant the data authority to make a case out of it, then yes. (provided everything else also applies, e.g. the things being talked about in the rest of this thread).
      - rblatz 8y ago
        Put it in your TOS that European users are forbidden from using your site, and then if they complain to a data authority press charges under the CFAA, and sue them for damages you incurred due to their violation. Then let the courts hash it out.
        roel_v 8y ago
- kinsomo 8y ago
  > Only if I make significant money from that market. If most of my revenue/profit comes from the US and it's problematic to "do business" in the EU or China, why wouldn't I want to just cut access off rather than dealing with potential hassles? Because you would rather grow your market?
  - eyeinthepyramid 8y ago
    There are 6.5 billion non-Europeans, there's plenty of market outside of Europe.
    - kinsomo 8y ago
      > There are 6.5 billion non-Europeans, there's plenty of market outside of Europe. The world doesn't have uniform GDP per capita. Potential European customers have more money to spend than most of those other potential customers. If you're looking for a new market, Europe is a juicy one.
  - taysic 8y ago
    If you run a free website that depends on targeted ads to make money, you might want to expand to the EU but now you'd need to totally change your business model to do so. For some that would basically mean inventing a new company because their service is not the type people would pay for. So in this case, it may not be worth it.
- jenscow 8y ago
  > But I've sent a clear message that I'm not marketing to European consumers. More like, sent a clear message you're not concerned of your user's data. (Nothing personal, the signal may not necessarily echo the reality)
rdlecler1 8y ago
False. The marginal cost of an EU customer is no longer zero. Why should I put in a bunch of work for GDPR compliance if the cost to implement it exceeds the initial marginal cost of an EU user. There is still the rest of the world.
- malka 8y ago
  Good. if you do not value my privacy, I dont want you to do business here. another product will replace your own. And in all likeness an EU one, meaning less euros leaving the eurozone. I'm all for it.
  - ryanwaggoner 8y ago
    if you do not value my privacy False equivalence. You can do nothing untoward with user data and still not be compliant.
    - jimmaswell 8y ago
      Exactly. The most basic/outrageous example: anyone in the EU who installs Apache and leaves it in its default configuration which logs all page visits indefinitely is now a criminal. Spin up a DO/Linode/etc. instance and apt-get install apache2? You're now theoretically liable for a 20 million Euro fine.
      - openIce 8y ago
        This is the most retarded comment I have read today. Literally everything you say is false
        jimmaswell 8y ago
        Are you disputing that GDPR disallows you from retaining visitor IPs, especially without explicit consent?
        8y ago
dageshi 8y ago
Launch in the rest of the world first, if you're successful then think about the EU. Seems like the way to go.
ww520 8y ago
If I run a free website, I have 0 revenue. Why would I care how big the EU market is?
reaperducer 8y ago
* The EU/EEA is the largest market in the world* Define "largest" in this context.
- reaperducer 8y ago
  Nevermind. I looked it up. The European Union is 7% of the world's population. So by "largest" he means "not largest," as in there's still 93% of the world left to do business with.
lajhsdfkl 8y ago
> The EU/EEA is the largest market in the world Please don't believe your own propaganda. EU/EEA revenue is a fraction of US revenue for all large multinationals. Small businesses probably make even less from the EU.

mrtksn 8y ago

So EU citizens will either revolt and destroy EU or read their news from somewhere else? More likely, will do the usual thing people do for geo-locked content: Use proxy or pirate until a convenient solution takes off. That convenient solution will be GDPR compliance by the offender or a competitor. I mean, mild annoyance is nothing compared to the annoyance of war thorn continent, I wouldn't bet too much on the destruction of EU or even withdrawal of GDPR

kodablah 8y ago
> So EU citizens will either revolt and destroy EU or read their news from somewhere else? Those are the only two options? Now that I know that, instead of what a practical person might deem as an option which is to repeal the law, the EU and GDPR proponents' mindsets make a lot more sense. I often wondered why new legislation was piled on older legislation that wasn't even enforced then, and why other statues wrt cookies and what not cannot be seen by legislators as more bad than good and worth removing. Now I know.
- mrtksn 8y ago
  My next sentence is literally a third option, describing what happens with geo-blocked content.
  - kodablah 8y ago
    And that it isn't even an option to recognize a bad law and repeal it, even if it had good intentions, speaks volumes.
    - mrtksn 8y ago
      As an EU citizen, I don't think the law is bad but you are free to be upset about it, of course. Please respect our laws and privacy or don't do business with us. We will be very sorry if your product is irreplaceable or we will use a competing product that complies with GDPR.

voidr 8y ago

> the result will probably be that a lot of free websites ban EU users Good riddance, at least we know what websites we shouldn't have visited in the first place. > smaller companies take their place with products that either cost money or will be a bit worse. Or they will be better and still be free. News companies are dying, news is commodity, if I can't read something on the LA times, I'm sure I'll find that same article on some other news site. > small competitors will be to afraid of the law and shut EU users out It's not a complicated piece of legislation, the short version is this simple: only collect data you actually need on your user to offer your service and be prepared to explain why, that's basically it. > But we as a society are willing to accept that if the result is that more loans will be "reasonable". The actual reason is that if you don't limit the loans, your economy will collapse.

ghaff 8y ago
>News companies are dying, news is commodity, if I can't read something on the LA times, I'm sure I'll find that same article on some other news site. Or the original news simply ceases to exist as is already happening at the local level in many cases. There's probably a continuing market for some global news organizations that are at least muddling through with subscriptions and other products. (Or not. See story on Time Inc. recently.) But I suspect the non-national/international journalism will continue to decline.
rdlecler1 8y ago
You assume that just because someone doesn’t want to got through all the hassle of being GDPR compliant that the website is somehow bad? Among other things this includes setting up an EU represeneitive—a high bar for a free product..... Obviously you haven’t had to deal with GDPR compliance.
- voidr 8y ago
  > You assume that just because someone doesn’t want to got through all the hassle of being GDPR compliant that the website is somehow bad? If they are not collecting any personal data, there is no hassle. Do you think it's somehow bad for a car manufacturer to not want to go through the hassle of making their cars conform to the safety standards? > Among other things this includes setting up an EU represeneitive Citation needed. > a high bar for a free product The product is not really free because users pay for it with their data, which was unclear before. > Obviously you haven’t had to deal with GDPR compliance. Obviously from what? Are you a GDPR compliance expert?

gutnor 8y ago

> then the result will probably be that a lot of free websites ban EU users and smaller companies take their place with products that either cost money or will be a bit worse. Availability of quality free content is not a problem, the content will just be available from other source. The big problem on the ads-monetized web today is ranking high enough, and the site that don't want to apply GDPR will just have to compete with the site that do have the extra push the EU market give them. On the advertizer side, they make direct money from content accessibility so they will upgrade their tracker so it is GDPR compliant for EU-traffic with no work from the content publisher. That is a non issue, this is just day one of a big change. Let's also not paint a rosy picture of the web either. GEO blocking is a common daily reality for people outside the US. Any valuable and popular content is locked already, despite being monetized quite directly (see Netflix, Amazon Prime, ...)

reaperducer 8y ago
>Availability of quality free content is not a problem Only if all content on every web site around the world is equal. Which it is not. If the quality was the same everywhere, and the same content was available everywhere, then people in Europe wouldn't have to go to web sites in other countries. There are lots of reasons for companies in Europe to need to read the Chicago Tribune (PR clipping service, for example). But the Tribune's content is no longer available to the E.U., and will not be replicated elsewhere for copyright reasons. As much as I dislike Tronc as an entity, I don't blame it for this decision. Within hours of GDPR going into effect, the lawsuits started flying. That's exactly why some companies decided it was easier to just opt out of Europe.
taysic 8y ago
The question is - the sites that serve massive amount of content (images, videos, etc) - will they be able to cover their costs in the EU without making their apps paid? What about currently free games which rely on personalized ads?