4 ms·

I always read that "we really need your personal data for no good reason but the EU won't let us, god bless America!" It really should be a 500 error, not a 40

I always read that "we really need your personal data for no good reason but the EU won't let us, god bless America!" It really should be a 500 error, not a 400. Edit: Listen, USA, it's not so difficult, and we all really need to stop siphoning off everyone's data like it's no big deal, laws or not. I wrote some stuff for the GDPR, just had to remove some emails from our database, and honestly, we shouldn't have been collecting them in the first place and neither should you. This surveillance capitalism we're all building is not a good thing and you should not be complicit in it.

kasey_junk 8y ago
Or possibly your foreign laws have made it impossible for us to determine if we are in compliance & it’s not worth it to figure out for a hyper local publication whose income comes from local ads.
- mindslight 8y ago
  That's an utterly disingenuous argument. The EU made an attempt at formally codifying a very basic boundary that most everybody intuitively understands - everybody except for the creepy advertising-surveillance industry which remains willfully ignorant. The answer is simple: don't surveil your users! Kind of sad to see 451 being used simply to throw a hissy fit, continuing to pretend that the surveillance is intrinsic - rather than deliberately set up to abuse visitors. But alas I guess this balkanization is just the next step on the path where users move away from http altogether.
  - Permit 8y ago
    > That's an utterly disingenuous argument. > The EU made an attempt at formally codifying a very basic boundary that most everybody intuitively understands - everybody except for the advertising-surveillance industry which remains willfully ignorant What is disingenuous is that you have tried reduced this argument down to "Everyone agrees with GDPR except for advertisers". Please recognize that plenty of HN users do not agree with GDPR.
    - mindslight 8y ago
      Yes, plenty of HN users work for the surveillance industry. You reduced the argument to being about support of the GDPR itself. I'm not in love with the specifics of the GDPR, just like I'm not in love with the concept of "sex offenders" needing to remain a certain distance away from schools. But they both exist in service of very straightforward boundaries.
  - tfehring 8y ago
    It’s totally possible that the site complies with all GDPR requirements but that it still makes business sense for it to block EU users. Verifying that they’re compliant would probably rack up sizeable legal fees, which could be far higher than the revenue they could expect to receive from readers in the EU.
    - analog31 8y ago
      Indeed, I subscribe to that newspaper, and they are not exactly swimming in money. If it's anything like electronic products, getting certified for export to the EU is an expensive proposition, and certainly not a DIY project.
      - DanBC 8y ago
        They don't offer their product in any of the EU languages (other than English, which is their first language), and they don't offer product in Euro. That means they're not targetting EU citizens, and can ignore GDPR.
        DuskStar 8y ago
        And have fun getting legal to sign off on that.
arketyp 8y ago
I read it "We don't want to be dragged into anything and your region is hardly a customer anyway."
baddox 8y ago
Or alternatively, they’re saying that the legislation is so confusing that figuring out how to abide by it is not worth the risk and cost.
- paulmd 8y ago
  "It is difficult to get a man to understand something, when his salary depends upon his not understanding it." It's not exactly complicated. Either get rid of their tracking cookies (why does a news website need tracking cookies to view an article?), or get consent before they use them. People don't want to stop tracking their users and so they feign like it's some insanely complex law. It's not complex at all, it's just one that made the thing you used to do illegal, and you need to stop doing it, or get consent before you do it. If maintaining a persistent session is somehow in the user's interest (say, maintaining an account at a store or online forum or something) then that's a legitimate-business-use exception. If it's for tracking/advertising/etc, then ask for consent, or presumptively don't do it. It's really not complex at all, unless you're being aggressively ignorant about it.
  - baddox 8y ago
    I am no expert, but I highly doubt it is really that simple, especially if the webmasters are particularly risk-averse. And why wouldn’t they be, if Europe is a relatively small portion of their user base? Why pay for an hour of a lawyer’s time, or even an hour of an employee’s time, to attempt to read and evaluate the laws?
    - DanBC 8y ago
      It doesn't seem too complicated. Recital 23: > In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. 3Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union. If this local newspaper isn't offering translations in French or German, and isn't offering subscriptions in Euro or GBP, then they're not ofering services to Europe.
TaylorAlexander 8y ago
It’s somewhat tricky. I operate a discourse instance. I have absolutely no desire to collect any personal information on my users(it is a free website and I am an anarchist), but I also live in the US and haven’t looked in to GDPR. The website is a hobby. I pay for the severs myself and do not display ads or use any tracking. I don’t intend to violate GDPR but I don’t know what it’s impkications are. For now I continue to make the site available for all, but if I felt there were legal implications to including Europe, I’d have to decide whether to block that region or do my due diligence. I’d want to include Europe given the subject of my site, but it’s something I haven’t looked in to yet. I do sometimes view sites that make a big deal out of it as whining, but I admit that I’m not familiar with what compliance requires.
- oh_sigh 8y ago
  GDPR only matters if your business is based in Europe, or targets European consumers in some substantial way. If you run a Madison, WI local newspaper, you don't need to choose between blocking EU users and following GDPR. You just ignore it and nothing will happen.
  - checkyoursudo 8y ago
    To me this seems like the reasonable answer. I guess I don't understand why this Madison website would even care about EU users or GDPR and why it would bother blocking visits it thinks are from the EU? Because they don't want to get bogged down in EU law? I've had clients with real cross/inter/multi-jurisdictional issues. This would not be one of them.
    - oh_sigh 8y ago
      Right - my point is that a lot of non-EU businesses over-reacted based on a poor understanding of the GDPR. Maybe their CIO read a blog post about American company X closing themselves to European customers, because they truly did attempt to market to Europeans and didn't think complying was worth it, and said 'Well, it ain't to hard to geo-block the EU' and went for it.
- 8y ago
Permit 8y ago
> Edit: Listen, USA, it's not such a big deal, and y'all really need to stop siphoning off everyone's data like it's no big deal, laws or not. I wrote some stuff for the GDPR, just had to remove some emails from our database, and honestly, we shouldn't have been collecting them in the first place and neither should you. This surveillance capitalism we're all building is not a good thing and you should not be complicit in it. This is incredibly patronizing. If I build a website in Canada, host it in Canada and primarily target it toward Canadians, don't complain when I have zero interest in learning about EU laws. I don't want to put a cookie popup on my website. I don't want to research GDPR. I don't want to worry about EU copyright law. I just want to build a website for my users.
- DanBC 8y ago
  > If I build a website in Canada, host it in Canada and primarily target it toward Canadians, don't complain when I have zero interest in learning about EU laws. You don't need to learn about EU laws, your product isn't covered by GDPR and all that will happen if your product somehow does fall under GDPR AND if it's non-compliant is that a bureaucrat will write a letter to you to either asking for more information or explaining how it's not compliant with suggestions about how to bring it back into compliance.
  - umanwizard 8y ago
    You may be right, but you're missing the point. The hypothetical Canadian webmaster probably hasn't seen this comment. If they have, they don't know you, and have no reason to trust your judgment about EU law. They could research it themselves, but that takes time. Most likely they have literally no idea what GDPR says, and don't care. So they just block the tiny proportion of EU visitors. Which is a completely rational -- it solves their problem at no cost to them.
aristophenes 8y ago
How familiar are you with internet laws in Malaysia? Because that is probably about how relevant EU laws are for a publisher for a small city in Wisconsin, normally. Until they make the front page of hacker news, that is. Whoever maintains their site is probably very confused at the moment, unless they are a HN reader themselves.
legitster 8y ago
"It is so simple! They just need to not have any cookies, advertisements, trackers, A/B testing, email signups, or javascript!" In your view of the internet, how does a site like this exist?
- Joe-Z 8y ago
  You do realize that static web-sites is what the internet was built on, right? It does work! And frankly, it‘s very well suited if all you want to do is display an article. Maybe i was woooshed here, not sure.
  - legitster 8y ago
    That argument seems to me akin to insisting the internet remain a platform for hobbyists and non-profit organizations. How does this site stay running and pay employees in this purer internet?
    - Joe-Z 8y ago
      By enabling people to subscribe to their content if they deem it worthy. Maybe have a free section where you serve static sites and for your more "in-depth" articles or whatever you make it subscriber-exclusive. I didn't want to argue we should revert to the internet of the 90's, but saying "how could you ever put anything on the web without cookies, tracking, data gathering?!" seems disingenuous when the internet was literally built without that. EDIT: Oh, I get it now. We just had different interpretations of what "exist" meant :) For me it was just "a site on the internet that can be reached by other people", for you it was more about the economic viablity. Fair point.
mynameishere 8y ago
it's not so difficult Neither is being raped. Very easy. How about your bureaucrats oppress you and otherwise fuck off? How about that?

kasey_junk 8y ago

Or possibly your foreign laws have made it impossible for us to determine if we are in compliance & it’s not worth it to figure out for a hyper local publication whose income comes from local ads.

mindslight 8y ago
That's an utterly disingenuous argument. The EU made an attempt at formally codifying a very basic boundary that most everybody intuitively understands - everybody except for the creepy advertising-surveillance industry which remains willfully ignorant. The answer is simple: don't surveil your users! Kind of sad to see 451 being used simply to throw a hissy fit, continuing to pretend that the surveillance is intrinsic - rather than deliberately set up to abuse visitors. But alas I guess this balkanization is just the next step on the path where users move away from http altogether.
- Permit 8y ago
  > That's an utterly disingenuous argument. > The EU made an attempt at formally codifying a very basic boundary that most everybody intuitively understands - everybody except for the advertising-surveillance industry which remains willfully ignorant What is disingenuous is that you have tried reduced this argument down to "Everyone agrees with GDPR except for advertisers". Please recognize that plenty of HN users do not agree with GDPR.
  - mindslight 8y ago
    Yes, plenty of HN users work for the surveillance industry. You reduced the argument to being about support of the GDPR itself. I'm not in love with the specifics of the GDPR, just like I'm not in love with the concept of "sex offenders" needing to remain a certain distance away from schools. But they both exist in service of very straightforward boundaries.
- tfehring 8y ago
  It’s totally possible that the site complies with all GDPR requirements but that it still makes business sense for it to block EU users. Verifying that they’re compliant would probably rack up sizeable legal fees, which could be far higher than the revenue they could expect to receive from readers in the EU.
  - analog31 8y ago
    Indeed, I subscribe to that newspaper, and they are not exactly swimming in money. If it's anything like electronic products, getting certified for export to the EU is an expensive proposition, and certainly not a DIY project.
    - DanBC 8y ago
      They don't offer their product in any of the EU languages (other than English, which is their first language), and they don't offer product in Euro. That means they're not targetting EU citizens, and can ignore GDPR.
      - DuskStar 8y ago
        And have fun getting legal to sign off on that.

arketyp 8y ago

I read it "We don't want to be dragged into anything and your region is hardly a customer anyway."

baddox 8y ago

Or alternatively, they’re saying that the legislation is so confusing that figuring out how to abide by it is not worth the risk and cost.

paulmd 8y ago
"It is difficult to get a man to understand something, when his salary depends upon his not understanding it." It's not exactly complicated. Either get rid of their tracking cookies (why does a news website need tracking cookies to view an article?), or get consent before they use them. People don't want to stop tracking their users and so they feign like it's some insanely complex law. It's not complex at all, it's just one that made the thing you used to do illegal, and you need to stop doing it, or get consent before you do it. If maintaining a persistent session is somehow in the user's interest (say, maintaining an account at a store or online forum or something) then that's a legitimate-business-use exception. If it's for tracking/advertising/etc, then ask for consent, or presumptively don't do it. It's really not complex at all, unless you're being aggressively ignorant about it.
- baddox 8y ago
  I am no expert, but I highly doubt it is really that simple, especially if the webmasters are particularly risk-averse. And why wouldn’t they be, if Europe is a relatively small portion of their user base? Why pay for an hour of a lawyer’s time, or even an hour of an employee’s time, to attempt to read and evaluate the laws?
  - DanBC 8y ago
    It doesn't seem too complicated. Recital 23: > In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. 3Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union. If this local newspaper isn't offering translations in French or German, and isn't offering subscriptions in Euro or GBP, then they're not ofering services to Europe.

TaylorAlexander 8y ago

It’s somewhat tricky. I operate a discourse instance. I have absolutely no desire to collect any personal information on my users(it is a free website and I am an anarchist), but I also live in the US and haven’t looked in to GDPR. The website is a hobby. I pay for the severs myself and do not display ads or use any tracking. I don’t intend to violate GDPR but I don’t know what it’s impkications are. For now I continue to make the site available for all, but if I felt there were legal implications to including Europe, I’d have to decide whether to block that region or do my due diligence. I’d want to include Europe given the subject of my site, but it’s something I haven’t looked in to yet. I do sometimes view sites that make a big deal out of it as whining, but I admit that I’m not familiar with what compliance requires.

oh_sigh 8y ago
GDPR only matters if your business is based in Europe, or targets European consumers in some substantial way. If you run a Madison, WI local newspaper, you don't need to choose between blocking EU users and following GDPR. You just ignore it and nothing will happen.
- checkyoursudo 8y ago
  To me this seems like the reasonable answer. I guess I don't understand why this Madison website would even care about EU users or GDPR and why it would bother blocking visits it thinks are from the EU? Because they don't want to get bogged down in EU law? I've had clients with real cross/inter/multi-jurisdictional issues. This would not be one of them.
  - oh_sigh 8y ago
    Right - my point is that a lot of non-EU businesses over-reacted based on a poor understanding of the GDPR. Maybe their CIO read a blog post about American company X closing themselves to European customers, because they truly did attempt to market to Europeans and didn't think complying was worth it, and said 'Well, it ain't to hard to geo-block the EU' and went for it.
8y ago

Permit 8y ago

> Edit: Listen, USA, it's not such a big deal, and y'all really need to stop siphoning off everyone's data like it's no big deal, laws or not. I wrote some stuff for the GDPR, just had to remove some emails from our database, and honestly, we shouldn't have been collecting them in the first place and neither should you. This surveillance capitalism we're all building is not a good thing and you should not be complicit in it. This is incredibly patronizing. If I build a website in Canada, host it in Canada and primarily target it toward Canadians, don't complain when I have zero interest in learning about EU laws. I don't want to put a cookie popup on my website. I don't want to research GDPR. I don't want to worry about EU copyright law. I just want to build a website for my users.

DanBC 8y ago
> If I build a website in Canada, host it in Canada and primarily target it toward Canadians, don't complain when I have zero interest in learning about EU laws. You don't need to learn about EU laws, your product isn't covered by GDPR and all that will happen if your product somehow does fall under GDPR AND if it's non-compliant is that a bureaucrat will write a letter to you to either asking for more information or explaining how it's not compliant with suggestions about how to bring it back into compliance.
- umanwizard 8y ago
  You may be right, but you're missing the point. The hypothetical Canadian webmaster probably hasn't seen this comment. If they have, they don't know you, and have no reason to trust your judgment about EU law. They could research it themselves, but that takes time. Most likely they have literally no idea what GDPR says, and don't care. So they just block the tiny proportion of EU visitors. Which is a completely rational -- it solves their problem at no cost to them.

aristophenes 8y ago

How familiar are you with internet laws in Malaysia? Because that is probably about how relevant EU laws are for a publisher for a small city in Wisconsin, normally. Until they make the front page of hacker news, that is. Whoever maintains their site is probably very confused at the moment, unless they are a HN reader themselves.

legitster 8y ago

"It is so simple! They just need to not have any cookies, advertisements, trackers, A/B testing, email signups, or javascript!" In your view of the internet, how does a site like this exist?

Joe-Z 8y ago
You do realize that static web-sites is what the internet was built on, right? It does work! And frankly, it‘s very well suited if all you want to do is display an article. Maybe i was woooshed here, not sure.
- legitster 8y ago
  That argument seems to me akin to insisting the internet remain a platform for hobbyists and non-profit organizations. How does this site stay running and pay employees in this purer internet?
  - Joe-Z 8y ago
    By enabling people to subscribe to their content if they deem it worthy. Maybe have a free section where you serve static sites and for your more "in-depth" articles or whatever you make it subscriber-exclusive. I didn't want to argue we should revert to the internet of the 90's, but saying "how could you ever put anything on the web without cookies, tracking, data gathering?!" seems disingenuous when the internet was literally built without that. EDIT: Oh, I get it now. We just had different interpretations of what "exist" meant :) For me it was just "a site on the internet that can be reached by other people", for you it was more about the economic viablity. Fair point.

mynameishere 8y ago

it's not so difficult Neither is being raped. Very easy. How about your bureaucrats oppress you and otherwise fuck off? How about that?