6 ms·

As a developer I can understand this point of view, but as a consumer I say it's time to grow up. Internet startups have taken a "move fast and break things" ap

As a developer I can understand this point of view, but as a consumer I say it's time to grow up. Internet startups have taken a "move fast and break things" approach that is analogous to early industrial revolution approaches to worker safety, product efficacy and safety, and environmental protection. You're working in the real world, with real consequences if you end up exposing people's personal data. The party is ending. Either deal with it, or find something else to do.

nordsieck 8y ago
> You're working in the real world, with real consequences if you end up exposing people's personal data. The party is ending. Either deal with it, or find something else to do. They are dealing with it... by limiting their liability.
- jacquesm 8y ago
  They are avoiding it. Essentially they are voting themselves off the island to avoid having to play nice with the other inhabitants.
  - matte_black 8y ago
    Companies can choose with whom and where they want to do business. The entire world is not entitled to everything Silicon Valley makes.
    - icebraining 8y ago
      Is anyone denying that they have that right?
    - freeflight 8y ago
      Considering Facebook even actively tracks non-users, where's the "users" choice of not participating in that glorious Silicon Valley invention? As far as I can tell, the "user" doesn't have a whole lot of choice there and Facebook isn't the only company doing that kind of aggregated data collection.
      - geocar 8y ago
        Facebook is based in Ireland ostensibly for tax reasons. I see them as a very poor example of good things coming out of Silicon Valley...
        freeflight 8y ago
        I'd agree with that if Facebook would be that single outlier nobody wants to emulate. But Silicon Valley isn't a monolith where everybody is on the same page about everything, I have no doubt there's plenty of people in SC who consider FB a success-model to be followed into a shining future.
  - dageshi 8y ago
    They're already on the one big island... they've just decided not to worry about the other big island across the sea yet because the one they're on is big enough for the time being.
  - jcims 8y ago
    Man if you could just stuff the endless stream of insults you might actually have a net positive effect for the global perspectives around GDPR.
    - jacquesm 8y ago
      Insults?
  - ovao 8y ago
    ...the other inhabitants who insist on maintaining control over the coconuts. If “fighting over coconuts” is not on their list of things they wish to do, it’s not a completely absurd choice.
  - deleted 8y ago
    [deleted]
  - newman8r 8y ago
    I think I'd use the term 'putting it off for later'. Almost like technical debt. I'd probably look more seriously at GDPR compliance at about the same time I start working on internationalization and localization. These are things I can put off until later, I don't need them to validate my startup concept. If the startup is successful, it might make sense to expand the market.
  - Matticus_Rex 8y ago
    That might be a great point if most of the costs of compliance actually did much good for data subjects.
  - tathougies 8y ago
    I mean... there's plenty of other islands where they can still make money, so why should they even bother?
- _o_ 8y ago
  Yeah but what they actually do is removing themself from market place. If I were looking for a startup, I would check for someone banning EU users, with prospective idea and copy what they have done, but GDPR oriented and voila, I am first on the market, slowly taking over the original site bussiness in EU and later the world. EU is a huge marketplace and you really need to be extremly short minded to avoid it due to some stupi legislation, not to mention that as a US cityzen I would abandon any site not going for GDPR compliancy as they are saying to me, between the lines, "we are bastardising my data". Like seeing a laser pointer on your forehead.
  - newman8r 8y ago
    People already copy successful startups for international markets all the time, it's just the nature of the business.
  - tomatotomato37 8y ago
    Will that work if noncompliant company is offering its service for FREE* by funding everything selling data and you have to charge/use less valuable static ads? Just having a larger market doesn't automatically make you're product more successful, especially when that larger market needs more mundane localization efforts that the average startup probably won't invest in for a couple years GDPR or not Plus, blatently ignoring regulation is cheaper in the short term, and if you successfully leverage that advantage into revenue than you can start throwing money at the problem once the regulators finally do get around to prosecuting you. Worked for Uber.
    - disgruntledphd2 8y ago
      For my money, it hasn't worked for Uber until they start generating bucket-loads of cash. I do agree with your overall point though.
  - deltron3030 8y ago
    Only if your audience doesn't give a fuck about originality and community. You can't copy those. Even people in the EU care about who's fake and who's real.
newman8r 8y ago
I agree that exposing personal data is serious, and companies should be held responsible if they violate the terms of their privacy policy. I think companies should follow the law of the land. The thing about GDPR that I disagree with is how it aims to have global jurisdiction. If it was a US law (as a US-based developer), perhaps I'd protest it, but I'd still follow it if I wanted to work in software.
- bialpio 8y ago
  But just because it requires changes affecting companies outside of EU that doesn't make the jurisdiction global. It's the same as with any other product that you are selling - if you want to sell it in EU, it has to satisfy EU's rules, irrespective of where it's being assembled / produced. So if you "sell" to EU residents, follow EU's rules.
  - newman8r 8y ago
    I think that's fair, but I don't think it's necessarily fair to put the responsibility on foreign websites to do the blocking and vetting. If the EU wanted to block websites that aren't compliant, that would make more sense IMO.
  - Aloisius 8y ago
    > So if you "sell" to EU residents, follow EU's rules. Surely this will just result in the development of the reseller model? As long as the reseller doesn't collect data, they're protected and as long as the US company doesn't maintain a presence or ideally market to the EU, they're untouchable due to the lack of any EU-US enforcement agreement for the GDPR.
    - geocar 8y ago
      Part of the length/complexity of the GDPR text is to deal with "cool hacks" like this to avoid having to spend money on IT security or to respect user preferences.
vmarsy 8y ago
I feel that you're ignoring the situation of small startups with just a few founders. At this stage, it can really kill your business to spend a lot of your resources on making sure you're complying with GDPR. Usually the 'consumer' of those startups are OK to take some risk, heck a lot might even sign up with dummy emails. The Poland proposal [1] to limit GDPR compliance to only large businesses was trying to address that. But it's flawed, because a small company (Cambridge Analytics) could still make a lot of damage to users' privacy... but the intent of Poland was good. I feel there should be an opt-out based on the numbers of users and the age of the company/service: If you can easily prove that you're not handling more than X users and your company is less than 2 years old, then GDPR does not apply yet, as long as you warn clearly on your website that you're not-yet-falling-under-GDPR. If you're still in the GDPR-waiver zone but believe to be GDPR compliant, then you can remove the warning and are subject to GDPR like every other company. That way entrepreneurs won't be scared to try some MVP here and there. I'm especially thinking of those trying to start a startup in countries that are part of the E.U.. The rest of the world entrepreneurs can just focus on their local userbase. [1] https://iapp.org/news/a/polands-proposed-gdpr-exemptions-spark-outrage/ https://iapp.org/news/a/polands-proposed-gdpr-exemptions-spa...
- turbinerneiter 8y ago
  It's like a small car maker saying that it can't be expected of them to comply with basic road safety regulations. "We are a startup on a shoestring budget, we can't put safety belts in our cars!!!" The cost of being in the car business is to build safe cars. The cost of being in the webservice business is to protect userdata. If you can't, you are not good enough to be allowed on the market. If you disagree, should the US also stop prosecuting VW for the diesel cheating?
  - globuous 8y ago
    Going along that, it's also like 3D printing house startups no complying with fire safety regulations in the name of "oh no, it's too expensive, let's just not deal with that". Actually, thinking about it, such startups would probably start somewhere where regulations are laxer, make money there, then invest in security, and finally expand to western countries where subject to massive regulations. I don't want unsafe houses, I don't want unsafe cars, and I don't want unsafe websites. Some other countries don't mind about that. To each their own, what's so ridiculous about that ? Great point about VW btw, I forgot about that !
threatofrain 8y ago
But you're not the only consumer, and your dollar is your biggest voice. Other consumers may be voicing a different concept of maturity than yours.

nordsieck 8y ago

> You're working in the real world, with real consequences if you end up exposing people's personal data. The party is ending. Either deal with it, or find something else to do. They are dealing with it... by limiting their liability.

jacquesm 8y ago
They are avoiding it. Essentially they are voting themselves off the island to avoid having to play nice with the other inhabitants.
- matte_black 8y ago
  Companies can choose with whom and where they want to do business. The entire world is not entitled to everything Silicon Valley makes.
  - icebraining 8y ago
    Is anyone denying that they have that right?
  - freeflight 8y ago
    Considering Facebook even actively tracks non-users, where's the "users" choice of not participating in that glorious Silicon Valley invention? As far as I can tell, the "user" doesn't have a whole lot of choice there and Facebook isn't the only company doing that kind of aggregated data collection.
    - geocar 8y ago
      Facebook is based in Ireland ostensibly for tax reasons. I see them as a very poor example of good things coming out of Silicon Valley...
      - freeflight 8y ago
        I'd agree with that if Facebook would be that single outlier nobody wants to emulate. But Silicon Valley isn't a monolith where everybody is on the same page about everything, I have no doubt there's plenty of people in SC who consider FB a success-model to be followed into a shining future.
- dageshi 8y ago
  They're already on the one big island... they've just decided not to worry about the other big island across the sea yet because the one they're on is big enough for the time being.
- jcims 8y ago
  Man if you could just stuff the endless stream of insults you might actually have a net positive effect for the global perspectives around GDPR.
  - jacquesm 8y ago
    Insults?
- ovao 8y ago
  ...the other inhabitants who insist on maintaining control over the coconuts. If “fighting over coconuts” is not on their list of things they wish to do, it’s not a completely absurd choice.
- deleted 8y ago
  [deleted]
- newman8r 8y ago
  I think I'd use the term 'putting it off for later'. Almost like technical debt. I'd probably look more seriously at GDPR compliance at about the same time I start working on internationalization and localization. These are things I can put off until later, I don't need them to validate my startup concept. If the startup is successful, it might make sense to expand the market.
- Matticus_Rex 8y ago
  That might be a great point if most of the costs of compliance actually did much good for data subjects.
- tathougies 8y ago
  I mean... there's plenty of other islands where they can still make money, so why should they even bother?
_o_ 8y ago
Yeah but what they actually do is removing themself from market place. If I were looking for a startup, I would check for someone banning EU users, with prospective idea and copy what they have done, but GDPR oriented and voila, I am first on the market, slowly taking over the original site bussiness in EU and later the world. EU is a huge marketplace and you really need to be extremly short minded to avoid it due to some stupi legislation, not to mention that as a US cityzen I would abandon any site not going for GDPR compliancy as they are saying to me, between the lines, "we are bastardising my data". Like seeing a laser pointer on your forehead.
- newman8r 8y ago
  People already copy successful startups for international markets all the time, it's just the nature of the business.
- tomatotomato37 8y ago
  Will that work if noncompliant company is offering its service for FREE* by funding everything selling data and you have to charge/use less valuable static ads? Just having a larger market doesn't automatically make you're product more successful, especially when that larger market needs more mundane localization efforts that the average startup probably won't invest in for a couple years GDPR or not Plus, blatently ignoring regulation is cheaper in the short term, and if you successfully leverage that advantage into revenue than you can start throwing money at the problem once the regulators finally do get around to prosecuting you. Worked for Uber.
  - disgruntledphd2 8y ago
    For my money, it hasn't worked for Uber until they start generating bucket-loads of cash. I do agree with your overall point though.
- deltron3030 8y ago
  Only if your audience doesn't give a fuck about originality and community. You can't copy those. Even people in the EU care about who's fake and who's real.

newman8r 8y ago

I agree that exposing personal data is serious, and companies should be held responsible if they violate the terms of their privacy policy. I think companies should follow the law of the land. The thing about GDPR that I disagree with is how it aims to have global jurisdiction. If it was a US law (as a US-based developer), perhaps I'd protest it, but I'd still follow it if I wanted to work in software.

bialpio 8y ago
But just because it requires changes affecting companies outside of EU that doesn't make the jurisdiction global. It's the same as with any other product that you are selling - if you want to sell it in EU, it has to satisfy EU's rules, irrespective of where it's being assembled / produced. So if you "sell" to EU residents, follow EU's rules.
- newman8r 8y ago
  I think that's fair, but I don't think it's necessarily fair to put the responsibility on foreign websites to do the blocking and vetting. If the EU wanted to block websites that aren't compliant, that would make more sense IMO.
- Aloisius 8y ago
  > So if you "sell" to EU residents, follow EU's rules. Surely this will just result in the development of the reseller model? As long as the reseller doesn't collect data, they're protected and as long as the US company doesn't maintain a presence or ideally market to the EU, they're untouchable due to the lack of any EU-US enforcement agreement for the GDPR.
  - geocar 8y ago
    Part of the length/complexity of the GDPR text is to deal with "cool hacks" like this to avoid having to spend money on IT security or to respect user preferences.

vmarsy 8y ago

I feel that you're ignoring the situation of small startups with just a few founders. At this stage, it can really kill your business to spend a lot of your resources on making sure you're complying with GDPR. Usually the 'consumer' of those startups are OK to take some risk, heck a lot might even sign up with dummy emails. The Poland proposal [1] to limit GDPR compliance to only large businesses was trying to address that. But it's flawed, because a small company (Cambridge Analytics) could still make a lot of damage to users' privacy... but the intent of Poland was good. I feel there should be an opt-out based on the numbers of users and the age of the company/service: If you can easily prove that you're not handling more than X users and your company is less than 2 years old, then GDPR does not apply yet, as long as you warn clearly on your website that you're not-yet-falling-under-GDPR. If you're still in the GDPR-waiver zone but believe to be GDPR compliant, then you can remove the warning and are subject to GDPR like every other company. That way entrepreneurs won't be scared to try some MVP here and there. I'm especially thinking of those trying to start a startup in countries that are part of the E.U.. The rest of the world entrepreneurs can just focus on their local userbase. [1] https://iapp.org/news/a/polands-proposed-gdpr-exemptions-spark-outrage/ https://iapp.org/news/a/polands-proposed-gdpr-exemptions-spa...

turbinerneiter 8y ago
It's like a small car maker saying that it can't be expected of them to comply with basic road safety regulations. "We are a startup on a shoestring budget, we can't put safety belts in our cars!!!" The cost of being in the car business is to build safe cars. The cost of being in the webservice business is to protect userdata. If you can't, you are not good enough to be allowed on the market. If you disagree, should the US also stop prosecuting VW for the diesel cheating?
- globuous 8y ago
  Going along that, it's also like 3D printing house startups no complying with fire safety regulations in the name of "oh no, it's too expensive, let's just not deal with that". Actually, thinking about it, such startups would probably start somewhere where regulations are laxer, make money there, then invest in security, and finally expand to western countries where subject to massive regulations. I don't want unsafe houses, I don't want unsafe cars, and I don't want unsafe websites. Some other countries don't mind about that. To each their own, what's so ridiculous about that ? Great point about VW btw, I forgot about that !

threatofrain 8y ago

But you're not the only consumer, and your dollar is your biggest voice. Other consumers may be voicing a different concept of maturity than yours.