11 ms·

You can still run a free website and be compliant with the GDPR. The EU/EEA is the largest market in the world, closing yourself for an market that size will hu

You can still run a free website and be compliant with the GDPR. The EU/EEA is the largest market in the world, closing yourself for an market that size will hurt more than changing a few thing to be compliant.

ghaff 8y ago
>closing yourself for an market that size will hurt more than changing a few thing to be compliant Only if I make significant money from that market. If most of my revenue/profit comes from the US and it's problematic to "do business" in the EU or China, why wouldn't I want to just cut access off rather than dealing with potential hassles? The fact that it's potentially a large market is irrelevant to me. In this case, any moderately tech-savvy consumers can get to my site anyway using a VPN. But I've sent a clear message that I'm not marketing to European consumers.
- akie 8y ago
  Well, you could! We’d be happy for you to make some space for a competitor who doesn’t make his money selling personal data.
- IshKebab 8y ago
  They could still make some money from showing non-tracking ads to European users and tracking ads to American ones. Perhaps not as much, but as they have already written the content I don't see why you would just give up on that revenue stream.
  - ghaff 8y ago
    The point is that, if I'm not making material money from EU residents today, it may be easier for me to just make it clear that I'm not trying to do business in the EU than figuring out if I need to do anything to become compliant. I may in fact be 100% compliant, but it may take effort to figure that out and there's potentially still some risk. Personally, I do no tracking on my sites so it's irrelevant to me but I understand why news sites with primarily local readership would decide dealing with the EU is more trouble than it's worth.
    - mlthoughts2018 8y ago
      This could definitely happen, but would not make sense for the Chicago Tribune and LA Times, which are big corporate entities united as subsidiaries of Tronc, Inc., and could even pool resources to have one compliance office among them from the parent company. For a large, well-capitalized company to make this choice, it’s an indication of a few possibilities: - Tronc doesn’t practice anything close to adequate IT practices to even know its compliance status, and pefers not to invest in doing so. - Tronc can’t remain profitable if displaying GDPR-compliant pages in EU (this seems fleetingly unlikely, given the specific attempts to grow digital subscribership by marketing the papers as more global). - Tronc is trying to make a political statement, like a boycott, hoping that many companies do this and it puts pressure on mitigating GDPR. So while I agree with you for some small businesses just not wanting to mess with GDPR compliance or risks, however small, it certainly isn’t aviable explanation for these newspapers.
      - JackFaker 8y ago
        It's likely that it's just side effect of months of institutional paralysis. The Chairman of Tronc stepped down earlier this year after allegations of misconduct and I believe they were negotiating the sale of the LA Times to an investor and the rest of the company to Softbank.
- mrtksn 8y ago
  When you don't a competitor steps in and if the day comes that you want some EU sales, you will have to spend huge sums to establish your brand if you are not a huge brand that's on TV shows and the News all the time. Geo-locked products are nothing new. I lived in a communist country, few EU countries and a middle eastern country and I can promise you that when a certain brand is not available a local competitor pops up and after the original brand becomes available it stays remain a curiosity unless it's a massive pop culture icon(McDonald's, CocaCola, Amazon, Netflix etc. - stuff that's on American TV shows all time. The TV Shows are also geo-locked but local pirates make them available few hours after the USA. Even in Cuba). So, it's not a simple problem of if(profit < feel like worth it) then block EU.
- roel_v 8y ago
  I see this 'VPN' argument a lot, but it's wrong. If the Chicago Tribune tracks users accessing their site through a VPN, without informed consent, they are in violation. Art 3 para 2 in b makes the Regulation apply to them and doesn't make provisions about whether the controller or processor has a way to find out if the behaviour of the data subject takes place within the Union. I don't see any reason for a different interpretation in the Recitals, either. Furthermore note that subs a and b in art 3 para 2 are alternative, not cumulative requirements. Let me rephrase: when you collect data on people with the goal to do behavioral / preference analysis on it, it doesn't matter any more whether or not you're 'marketing' to them, or even that you 'send them a clear message' you don't 'market to them'. The GDPR still applies to you.
  - philipov 8y ago
    So you're saying that if I block my site to EU IPs, and someone uses a VPN to look like they're coming from the US and bypass that, they can then sue me under the GDPR? No way.
    - roel_v 8y ago
      No, they can't 'sue' you; they can make a complaint to their data authority who will then decide if and what to do about it. So if your site blocks EU IPs and you then violate the privacy of someone in the EU grossly enough to warrant the data authority to make a case out of it, then yes. (provided everything else also applies, e.g. the things being talked about in the rest of this thread).
      - rblatz 8y ago
        Put it in your TOS that European users are forbidden from using your site, and then if they complain to a data authority press charges under the CFAA, and sue them for damages you incurred due to their violation. Then let the courts hash it out.
        roel_v 8y ago
- kinsomo 8y ago
  > Only if I make significant money from that market. If most of my revenue/profit comes from the US and it's problematic to "do business" in the EU or China, why wouldn't I want to just cut access off rather than dealing with potential hassles? Because you would rather grow your market?
  - eyeinthepyramid 8y ago
    There are 6.5 billion non-Europeans, there's plenty of market outside of Europe.
    - kinsomo 8y ago
      > There are 6.5 billion non-Europeans, there's plenty of market outside of Europe. The world doesn't have uniform GDP per capita. Potential European customers have more money to spend than most of those other potential customers. If you're looking for a new market, Europe is a juicy one.
  - taysic 8y ago
    If you run a free website that depends on targeted ads to make money, you might want to expand to the EU but now you'd need to totally change your business model to do so. For some that would basically mean inventing a new company because their service is not the type people would pay for. So in this case, it may not be worth it.
- jenscow 8y ago
  > But I've sent a clear message that I'm not marketing to European consumers. More like, sent a clear message you're not concerned of your user's data. (Nothing personal, the signal may not necessarily echo the reality)
rdlecler1 8y ago
False. The marginal cost of an EU customer is no longer zero. Why should I put in a bunch of work for GDPR compliance if the cost to implement it exceeds the initial marginal cost of an EU user. There is still the rest of the world.
- malka 8y ago
  Good. if you do not value my privacy, I dont want you to do business here. another product will replace your own. And in all likeness an EU one, meaning less euros leaving the eurozone. I'm all for it.
  - ryanwaggoner 8y ago
    if you do not value my privacy False equivalence. You can do nothing untoward with user data and still not be compliant.
    - jimmaswell 8y ago
      Exactly. The most basic/outrageous example: anyone in the EU who installs Apache and leaves it in its default configuration which logs all page visits indefinitely is now a criminal. Spin up a DO/Linode/etc. instance and apt-get install apache2? You're now theoretically liable for a 20 million Euro fine.
      - openIce 8y ago
        This is the most retarded comment I have read today. Literally everything you say is false
        jimmaswell 8y ago
        Are you disputing that GDPR disallows you from retaining visitor IPs, especially without explicit consent?
        8y ago
dageshi 8y ago
Launch in the rest of the world first, if you're successful then think about the EU. Seems like the way to go.
ww520 8y ago
If I run a free website, I have 0 revenue. Why would I care how big the EU market is?
reaperducer 8y ago
* The EU/EEA is the largest market in the world* Define "largest" in this context.
- reaperducer 8y ago
  Nevermind. I looked it up. The European Union is 7% of the world's population. So by "largest" he means "not largest," as in there's still 93% of the world left to do business with.
lajhsdfkl 8y ago
> The EU/EEA is the largest market in the world Please don't believe your own propaganda. EU/EEA revenue is a fraction of US revenue for all large multinationals. Small businesses probably make even less from the EU.

ghaff 8y ago

>closing yourself for an market that size will hurt more than changing a few thing to be compliant Only if I make significant money from that market. If most of my revenue/profit comes from the US and it's problematic to "do business" in the EU or China, why wouldn't I want to just cut access off rather than dealing with potential hassles? The fact that it's potentially a large market is irrelevant to me. In this case, any moderately tech-savvy consumers can get to my site anyway using a VPN. But I've sent a clear message that I'm not marketing to European consumers.

akie 8y ago
Well, you could! We’d be happy for you to make some space for a competitor who doesn’t make his money selling personal data.
IshKebab 8y ago
They could still make some money from showing non-tracking ads to European users and tracking ads to American ones. Perhaps not as much, but as they have already written the content I don't see why you would just give up on that revenue stream.
- ghaff 8y ago
  The point is that, if I'm not making material money from EU residents today, it may be easier for me to just make it clear that I'm not trying to do business in the EU than figuring out if I need to do anything to become compliant. I may in fact be 100% compliant, but it may take effort to figure that out and there's potentially still some risk. Personally, I do no tracking on my sites so it's irrelevant to me but I understand why news sites with primarily local readership would decide dealing with the EU is more trouble than it's worth.
  - mlthoughts2018 8y ago
    This could definitely happen, but would not make sense for the Chicago Tribune and LA Times, which are big corporate entities united as subsidiaries of Tronc, Inc., and could even pool resources to have one compliance office among them from the parent company. For a large, well-capitalized company to make this choice, it’s an indication of a few possibilities: - Tronc doesn’t practice anything close to adequate IT practices to even know its compliance status, and pefers not to invest in doing so. - Tronc can’t remain profitable if displaying GDPR-compliant pages in EU (this seems fleetingly unlikely, given the specific attempts to grow digital subscribership by marketing the papers as more global). - Tronc is trying to make a political statement, like a boycott, hoping that many companies do this and it puts pressure on mitigating GDPR. So while I agree with you for some small businesses just not wanting to mess with GDPR compliance or risks, however small, it certainly isn’t aviable explanation for these newspapers.
    - JackFaker 8y ago
      It's likely that it's just side effect of months of institutional paralysis. The Chairman of Tronc stepped down earlier this year after allegations of misconduct and I believe they were negotiating the sale of the LA Times to an investor and the rest of the company to Softbank.
mrtksn 8y ago
When you don't a competitor steps in and if the day comes that you want some EU sales, you will have to spend huge sums to establish your brand if you are not a huge brand that's on TV shows and the News all the time. Geo-locked products are nothing new. I lived in a communist country, few EU countries and a middle eastern country and I can promise you that when a certain brand is not available a local competitor pops up and after the original brand becomes available it stays remain a curiosity unless it's a massive pop culture icon(McDonald's, CocaCola, Amazon, Netflix etc. - stuff that's on American TV shows all time. The TV Shows are also geo-locked but local pirates make them available few hours after the USA. Even in Cuba). So, it's not a simple problem of if(profit < feel like worth it) then block EU.
roel_v 8y ago
I see this 'VPN' argument a lot, but it's wrong. If the Chicago Tribune tracks users accessing their site through a VPN, without informed consent, they are in violation. Art 3 para 2 in b makes the Regulation apply to them and doesn't make provisions about whether the controller or processor has a way to find out if the behaviour of the data subject takes place within the Union. I don't see any reason for a different interpretation in the Recitals, either. Furthermore note that subs a and b in art 3 para 2 are alternative, not cumulative requirements. Let me rephrase: when you collect data on people with the goal to do behavioral / preference analysis on it, it doesn't matter any more whether or not you're 'marketing' to them, or even that you 'send them a clear message' you don't 'market to them'. The GDPR still applies to you.
- philipov 8y ago
  So you're saying that if I block my site to EU IPs, and someone uses a VPN to look like they're coming from the US and bypass that, they can then sue me under the GDPR? No way.
  - roel_v 8y ago
    No, they can't 'sue' you; they can make a complaint to their data authority who will then decide if and what to do about it. So if your site blocks EU IPs and you then violate the privacy of someone in the EU grossly enough to warrant the data authority to make a case out of it, then yes. (provided everything else also applies, e.g. the things being talked about in the rest of this thread).
    - rblatz 8y ago
      Put it in your TOS that European users are forbidden from using your site, and then if they complain to a data authority press charges under the CFAA, and sue them for damages you incurred due to their violation. Then let the courts hash it out.
      - roel_v 8y ago
kinsomo 8y ago
> Only if I make significant money from that market. If most of my revenue/profit comes from the US and it's problematic to "do business" in the EU or China, why wouldn't I want to just cut access off rather than dealing with potential hassles? Because you would rather grow your market?
- eyeinthepyramid 8y ago
  There are 6.5 billion non-Europeans, there's plenty of market outside of Europe.
  - kinsomo 8y ago
    > There are 6.5 billion non-Europeans, there's plenty of market outside of Europe. The world doesn't have uniform GDP per capita. Potential European customers have more money to spend than most of those other potential customers. If you're looking for a new market, Europe is a juicy one.
- taysic 8y ago
  If you run a free website that depends on targeted ads to make money, you might want to expand to the EU but now you'd need to totally change your business model to do so. For some that would basically mean inventing a new company because their service is not the type people would pay for. So in this case, it may not be worth it.
jenscow 8y ago
> But I've sent a clear message that I'm not marketing to European consumers. More like, sent a clear message you're not concerned of your user's data. (Nothing personal, the signal may not necessarily echo the reality)

rdlecler1 8y ago

False. The marginal cost of an EU customer is no longer zero. Why should I put in a bunch of work for GDPR compliance if the cost to implement it exceeds the initial marginal cost of an EU user. There is still the rest of the world.

malka 8y ago
Good. if you do not value my privacy, I dont want you to do business here. another product will replace your own. And in all likeness an EU one, meaning less euros leaving the eurozone. I'm all for it.
- ryanwaggoner 8y ago
  if you do not value my privacy False equivalence. You can do nothing untoward with user data and still not be compliant.
  - jimmaswell 8y ago
    Exactly. The most basic/outrageous example: anyone in the EU who installs Apache and leaves it in its default configuration which logs all page visits indefinitely is now a criminal. Spin up a DO/Linode/etc. instance and apt-get install apache2? You're now theoretically liable for a 20 million Euro fine.
    - openIce 8y ago
      This is the most retarded comment I have read today. Literally everything you say is false
      - jimmaswell 8y ago
        Are you disputing that GDPR disallows you from retaining visitor IPs, especially without explicit consent?
        8y ago

dageshi 8y ago

Launch in the rest of the world first, if you're successful then think about the EU. Seems like the way to go.

ww520 8y ago

If I run a free website, I have 0 revenue. Why would I care how big the EU market is?

reaperducer 8y ago

* The EU/EEA is the largest market in the world* Define "largest" in this context.

reaperducer 8y ago
Nevermind. I looked it up. The European Union is 7% of the world's population. So by "largest" he means "not largest," as in there's still 93% of the world left to do business with.

lajhsdfkl 8y ago

> The EU/EEA is the largest market in the world Please don't believe your own propaganda. EU/EEA revenue is a fraction of US revenue for all large multinationals. Small businesses probably make even less from the EU.