4 ms·

How are these different from GDPR? Most global companies should already have most of this in place, so it will just hurt the small businesses which has yet to e

How are these different from GDPR? Most global companies should already have most of this in place, so it will just hurt the small businesses which has yet to expand outside the states. Is there some limit to company size here to avoid that?

pkaye 7y ago
> The CCPA only applies to companies with more than $25 million in revenue or access to the personal information of more than 50,000 people.
- sillysaurusx 7y ago
  50,000 is not a lot. If you set up a YouTube competitor and the view counter on a video has more than 50,000 views, do you qualify? What if you use cookies? It’s a personal ID of all 50,000 viewers.
  - unlinked_dll 7y ago
    Awesome, fewer people using cookies to track me.
  - dependenttypes 7y ago
    Why would you need to use cookies for users that are not logged-in in a youtube clone?
esotericn 7y ago
You mean like all of the US news sites that just firewall off EU citizens at the moment?
- BrandoElFollito 7y ago
  I do not understand why they do that. If a US news outlet has no presence in the EU there is nothing which can be done if they do not follow EU rules.
  - moomin 7y ago
    It’s just a passive-aggressive hissy fit. The cost of writing the middleware to write out your angsty nonsense is higher than the cost of writing the middleware to just remove all cookies from every request. The EU detection logic is the same in both cases.
    - erik_seaberg 7y ago
      GDPR has a lot of burdensome requirements, like hiring a commissar and multi-month government review periods before features launches. Do not bet 21M USD that merely deleting cookies and logs will get you anywhere near compliance.
      - moomin 7y ago
        I'm not sure how serving up a custom page to EU addresses solves that problem either, though, so we come back to equivalence.
        erik_seaberg 7y ago
        The theory is that Article 3 stops the EU from coming after you (however they might try) if you don't offer goods or services to EU data subjects or monitor their behavior. The GDPR is roughly the size of a novel, and proving you're doing everything it requires is a hell of a lot more work than proving you're out of scope entirely.
      - elygre 7y ago
        > multi-month government review Can you explain this a bit more?
        erik_seaberg 7y ago
        It's still extremely vague how many releases will require the eight-week review with six-week extension in https://gdpr-info.eu/art-36-gdpr/ https://gdpr-info.eu/art-36-gdpr/, but this is the kind of friction and cost they're imposing even on groups who aren't doing anything bad.
- bsder 7y ago
  Then start an EU competitor that doesn't--most US news sites are simply repackaging content anyway. You should clean up, no?
  - esotericn 7y ago
    Did you read the post above mine? > How are these different from GDPR? Most global companies should already have most of this in place There are tons of companies, global or not, that don't have it in place. They won't be able to deal with it by firewalling off their home market.
    - bsder 7y ago
      And my point is that I don't see EU competitors jumping into the gap left by companies that simply firewall off the EU. Now, it could simply be that everybody is waiting to see if the GDPR enforcement is going to become aggressive before doing so. There is no point in trying to compete with an entrenched US company until the EU actually neuters them.
PeterisP 7y ago
For starters, one thing that the big global companies did was carefully internally segment EU/non-EU users so that they make the technical implementation and business processes to comply with GDPR, but apply these things only when necesseary, and keep the data processing of their (very profitable) USA users the same. A small or medium website most likely went either with privacy-for-everyone or ignore-the-GDPR, but any large global company can afford separate flows and has large enough financial incentives in mining that data so that it makes sense to differentiate. For example, Equifax has a bunch of subsidiaries in EU who have to follow GDPR - and mostly are following it, or at least make a decent show in attempting so; but the main USA Equifax business could not bother with it, to great benefit of Equifax itself and detriment of all the USA citizens whose data Equifax mismanaged.
csydas 7y ago
Most companies do not comply with GDPR, and it's not about the minutia, it's about just very basic concepts regarding user data and privacy. I'm a US expat and honestly its extremely frustrating to try to use sites I formerly was able to access (with µblock) due to either absolutely obtrusive and confusing opt-in/out policies (e.g., Oath) or complete rejections/refusal of anyone with an IP outside the US (this is exceptionally frustrating as I don't even live in the EU, but because the lazy solution of applying the GDPR block to any non-US address is often used, I cannot read many US new sites) Global companies have __not__ adapted to GDPR, and instead have just dragged their feet. I'm curious if the EU is going to do anything about it for sites that frequently do business in the EU, or if they will start enforcing actual GDPR policies on the big players (for example, Google is a beast to use in any EU member nation if you choose not to grant consent for data collection by just using element blocking) The idea that companies have complied with GDPR does not mesh with my experience actually trying to use websites in the Schengen Area. And I don't blame GDPR, I blame companies for the insane amount of data and tracking they want for viewing even a minute amount of content.

pkaye 7y ago

> The CCPA only applies to companies with more than $25 million in revenue or access to the personal information of more than 50,000 people.

sillysaurusx 7y ago
50,000 is not a lot. If you set up a YouTube competitor and the view counter on a video has more than 50,000 views, do you qualify? What if you use cookies? It’s a personal ID of all 50,000 viewers.
- unlinked_dll 7y ago
  Awesome, fewer people using cookies to track me.
- dependenttypes 7y ago
  Why would you need to use cookies for users that are not logged-in in a youtube clone?

esotericn 7y ago

You mean like all of the US news sites that just firewall off EU citizens at the moment?

BrandoElFollito 7y ago
I do not understand why they do that. If a US news outlet has no presence in the EU there is nothing which can be done if they do not follow EU rules.
- moomin 7y ago
  It’s just a passive-aggressive hissy fit. The cost of writing the middleware to write out your angsty nonsense is higher than the cost of writing the middleware to just remove all cookies from every request. The EU detection logic is the same in both cases.
  - erik_seaberg 7y ago
    GDPR has a lot of burdensome requirements, like hiring a commissar and multi-month government review periods before features launches. Do not bet 21M USD that merely deleting cookies and logs will get you anywhere near compliance.
    - moomin 7y ago
      I'm not sure how serving up a custom page to EU addresses solves that problem either, though, so we come back to equivalence.
      - erik_seaberg 7y ago
        The theory is that Article 3 stops the EU from coming after you (however they might try) if you don't offer goods or services to EU data subjects or monitor their behavior. The GDPR is roughly the size of a novel, and proving you're doing everything it requires is a hell of a lot more work than proving you're out of scope entirely.
    - elygre 7y ago
      > multi-month government review Can you explain this a bit more?
      - erik_seaberg 7y ago
        It's still extremely vague how many releases will require the eight-week review with six-week extension in https://gdpr-info.eu/art-36-gdpr/ https://gdpr-info.eu/art-36-gdpr/, but this is the kind of friction and cost they're imposing even on groups who aren't doing anything bad.
bsder 7y ago
Then start an EU competitor that doesn't--most US news sites are simply repackaging content anyway. You should clean up, no?
- esotericn 7y ago
  Did you read the post above mine? > How are these different from GDPR? Most global companies should already have most of this in place There are tons of companies, global or not, that don't have it in place. They won't be able to deal with it by firewalling off their home market.
  - bsder 7y ago
    And my point is that I don't see EU competitors jumping into the gap left by companies that simply firewall off the EU. Now, it could simply be that everybody is waiting to see if the GDPR enforcement is going to become aggressive before doing so. There is no point in trying to compete with an entrenched US company until the EU actually neuters them.

PeterisP 7y ago

For starters, one thing that the big global companies did was carefully internally segment EU/non-EU users so that they make the technical implementation and business processes to comply with GDPR, but apply these things only when necesseary, and keep the data processing of their (very profitable) USA users the same. A small or medium website most likely went either with privacy-for-everyone or ignore-the-GDPR, but any large global company can afford separate flows and has large enough financial incentives in mining that data so that it makes sense to differentiate. For example, Equifax has a bunch of subsidiaries in EU who have to follow GDPR - and mostly are following it, or at least make a decent show in attempting so; but the main USA Equifax business could not bother with it, to great benefit of Equifax itself and detriment of all the USA citizens whose data Equifax mismanaged.

csydas 7y ago

Most companies do not comply with GDPR, and it's not about the minutia, it's about just very basic concepts regarding user data and privacy. I'm a US expat and honestly its extremely frustrating to try to use sites I formerly was able to access (with µblock) due to either absolutely obtrusive and confusing opt-in/out policies (e.g., Oath) or complete rejections/refusal of anyone with an IP outside the US (this is exceptionally frustrating as I don't even live in the EU, but because the lazy solution of applying the GDPR block to any non-US address is often used, I cannot read many US new sites) Global companies have __not__ adapted to GDPR, and instead have just dragged their feet. I'm curious if the EU is going to do anything about it for sites that frequently do business in the EU, or if they will start enforcing actual GDPR policies on the big players (for example, Google is a beast to use in any EU member nation if you choose not to grant consent for data collection by just using element blocking) The idea that companies have complied with GDPR does not mesh with my experience actually trying to use websites in the Schengen Area. And I don't blame GDPR, I blame companies for the insane amount of data and tracking they want for viewing even a minute amount of content.