I understand the worries; and the fact that it's a local interest site. Hence the appeal to HN to block such links, since HN is presumably not local-interest.

I understand the worries; and the fact that it's a local interest site. Hence the appeal to HN to block such links, since HN is presumably not local-interest. But while the massive media blitz on the GDPR makes it appear terrifying; it doesn't magically grant jurisdiction over a local west virginia site. The enforcement agency isn't likely to bother, because they have no means to enforce any sanction. It's not even clear to me whether the GDPR even applies; article 3(1) says that "This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not." Is a west virginia site "established" in the EU? That's dubious enough that I doubt they need to worry - for now. Yes, if a hostile foreign regulator wanted to fine them - they probably could find some pretext. But that's likely the case under any number of other laws too! But there's simply no motivation for a foreign regulator to do so; and numerous motivations for them not to. (A) they might fail, (B) there's not much to win, even if they do, (C) they do actually need evidence, and if the site at least attempted not to collect PII, then there is likely not to be any easily accessible evidence, so it's going to be a lot of work, (D) the politics are terrible, which regulators are far from immune from; (E) even if they "win" it's not clear they can collect. The real risk here seems overstated - as in, does anybody think there is ever going to be a single case like this resulting in a fine? Literally ever? Note furthermore that their IP filter is likely insufficient anyhow. IP filters are never reliable for all kinds of reasons, e.g. VPNs, out of date filtering rules, etc, and the law applies to natural persons in the EU regardless of where you think they are. And it's not entirely clear to me that it doesn't apply to EU persons that happen to be on vacation (even if it does not, it almost certainly does the moment the vacation is over and the site has not wiped the PII - it's not like that magically dissappears). The only tricky bit in avoiding PII (for news sites!) is going to be embeds (i.e. ads). But this affects the adtech firms much more than them; most of them need to have some solution (e.g. a contextual ad mode). Some local news site almost certainly doesn't need to solve this; they likely only need to check the right box for the adtech firm to do so; which is probably not a lot harder than the solution they've chosen now. Finally: none of this is happening in a vacuum, nor overnight. The few cases so far have been either pretty egregious, limited to largely symbolic fines, or both. And that's just natural (given the way the GDPR was set up): the worst excesses are the most likely to be addressed first (don't forget that the GDPR is not enforceable by an individual no matter how egregious the violation, all they can do is refer a site, which serves as a filter). All in all: this sounds like an overreaction. Maybe it's a cultural thing too; lawsuits with huge punitive fines are much more common in the US, so the habit of avoiding liability is perhaps more deeply ingrained. But again, the risk seems trivial. And you know, if you don't care about overseas readers, would it kill you to be so polite as to say so? It currently says only: "Our European visitors are important to us. This site is currently unavailable to visitors from the European Economic Area while we work to ensure your data is protected in accordance with applicable EU laws." That's just a lie, likely both parts of it. But back to my original request: even if the site has zero costs from doing this, and it really wants to avoid accidental mistakes: that doesn't make them any less spam in the HN feed, which was my initial point: HN is less valuable to EU residents if contains spam like this.