4 ms·
Recital 23 [1] of the GDPR excludes most US-based businesses from compliance with GDPR. It essentially says that sites that don’t “envisage” (their word) offer
by downandout 8y ago
Recital 23 [1] of the GDPR excludes most US-based businesses from compliance with GDPR. It essentially says that sites that don’t “envisage” (their word) offering services in the EU are in fact not offering services there for the purposes of the GDPR and are thus are not subject to it. It also explicitly states that the mere accessibility of a foreign-based website from within the EU does not by itself subject the site to GDPR.
So while blocking the EU isn’t required, the other tests they use to determine whether or not you intended to offer services to EU residents are a bit murky. In light of that, what better way is there to make your intention to not serve EU users clear to all than to block EU users? That’s the main reason to do it. This kind of blockade will not prevent all EU users from accessing your site, but it doesn’t matter. You’ll have made your intent to not serve EU users clear, which will preserve your immunity to GDPR.
[1] http://www.privacy-regulation.eu/en/recital-23-GDPR.htm http://www.privacy-regulation.eu/en/recital-23-GDPR.htm
- johannes1234321 8y agoA point with many sites is that they use ad networks and those ad networks send localized ads to Europeans, thus the site targets (or "envisages") Europeans. Even if the actual content is about quite local things.
- downandout 8y agoIn my personal opinion, that would be both a stretch of this recital and an abusive use of the GDPR. You don’t control what ads are shown to anyone because they are served by a third party, and you have a good faith belief that you are not subject to GDPR under Recital 23. My guess is that if you used an ad network that specialized in EU ads, you’d be subject to it. But using code from a US ad network that may have some EU advertisers now or in the future shouldn’t expose you. But I don’t disagree that some EU countries that intend to abuse the GDPR for the purpose of generating massive amounts of revenue from fines may try to make this kind of claim. One of the problems with GDPR is that when you combine unclear regulation with the lack of moral hazard that government agencies enjoy and the financial incentive of massive fines, you create a monster that will constantly seek to expand who and what is covered under it.
- johannes1234321 8y agoYou control to whom you give the space on your site. You contract somebody to do this under the terms you negotiate with them. "This is somebody else, they are just paying me" won't work. (And well, if the ad network is GDPR compliant it is relatively little work for you to add the note, if they are not GDPR compliant they may not target Europeans)
- downandout 8y agoAgain, this argument is a stretch for sites that are otherwise immune under Recital 23. It is one that may be tested by the most abusive GDPR enforcers, but I believe that test will ultimately fail. Regardless, it’s one more reason to block radioactive EU traffic.
- johannes1234321 8y agoYour page is showing European ads and you are earning money of those. For me, as a user, the ad network is an implementation choice of your business. Probably you can offload some challenges to the ad network, if they don't tell you enough of their business, but that's between you and them. For me I'm accessing your site.
- s2g 8y agoI don't see how you can possibly say that. If I'm serving a german an ad in german, for a german business, then how the hell am I not clearly doing business in germany?
- downandout 8y agoIf I'm serving a german an ad in german You aren’t serving any ads in the case of an ad network. You contracted with an ad network that is within the US and the site on which you served their code is not otherwise subject to the GDPR. Your intent to not serve the EU market is clear.
- fiatjaf 8y agoFor those purposes, a simple JS snippet as provided by my https://euroshield.xyz/ https://euroshield.xyz/ would serve very well.