4 ms·

How is this GDPR compliant? What tracking is used for EU citizens? I've seen no consent notices here in the EU.

nannal 6y ago
File a complaint to your local gdpr body
SahAssar 6y ago
It isn't, but I'm guessing their argument is that the website owner should get consent before loading their code. Of course in practice basically no one does that and they seem to be banking on that fact.
- 3np 6y ago
  Disqus is not necessarily off the hook here. GDPR identifies several roles with different requirements (Data Processor, Data Controller)
mmgu 6y ago
Disqus does not track users from GDPR countries by default. My initial story in December 2019 for the Norwegian broadcaster NRK was a result of Disqus not knowing Norway had the GDPR (we are part of EEA, but not EU). Users are checked based on IP whether they come from a GDPR country. If GDPR, they will be put in private mode. A user needs to create a profile and consent to sharing for tracking to begin. Norwegian DPA opened an investigation as a result of our stories and Norwegians are now in private mode by default.
- seanhunter 6y ago
  Fair to say this is necessary but not sufficient. GDPR covers users within GDPR countries but also European data subjects wherever they are in the world.
  - Daho0n 6y ago
    This gets repeated over and over on HN but it isn't true. I feel this is because so many try to make GDPR seem too hard and breaking everything (likely people with something to lose). GDPR is for data in the EU. That is it. Not data outside the EU and not people outside the EU. An American in the EU is covered, an EU citizen in the US is not. What you are saying would require that the EU could create laws that were above the Supreme Court in the US for example. It simply isn't true.
    - h_anna_h 6y ago
      > I feel this is because so many try to make GDPR seem too hard and breaking everything (likely people with something to lose). Or people who wish to extend the reach of GDPR so that others outside of the EU are protected too. > What you are saying would require that the EU could create laws that were above the Supreme Court in the US for example This is not true for multiple reasons. Check out https://en.wikipedia.org/wiki/PROTECT_Act_of_2003 https://en.wikipedia.org/wiki/PROTECT_Act_of_2003 specifically "Authorizes fines and/or imprisonment for up to 30 years for U.S. citizens or residents who engage in illicit sexual conduct abroad". The EU could punish US companies that have offices in the EU or income from the EU. Alternatively it could sanction them.
      - Daho0n 6y ago
        Let me rephrase: If the data is in the EU it is covered by GDPR no matter where the person that creates the data is at (yes in the US too) but the person isn't covered by the GDPR, the data (that is in the EU) is covered. It is not the same thing. What most people seem to think is the EU overreaching and "making laws that reach outsides its borders" is in cases where a foreign company (like Facebook) gets regulated by GDPR even though the company is outside the EU. This is because the data is in the EU and of course data in the EU isn't under US or any other entities law but EU (and member states). If you transfer data outside the EU you either do so illegally or have to follow the rules of the GDPR. It still doesn't reach outside the EU borders. Of course if you do something criminally the EU might judge you no matter where you are at just like the US with PROTECT Act of 2003 but that is another matter.
- unicornporn 6y ago
  Thanks for this!

File a complaint to your local gdpr body

It isn't, but I'm guessing their argument is that the website owner should get consent before loading their code. Of course in practice basically no one does that and they seem to be banking on that fact.

3np 6y ago
Disqus is not necessarily off the hook here. GDPR identifies several roles with different requirements (Data Processor, Data Controller)

mmgu 6y ago

Disqus does not track users from GDPR countries by default. My initial story in December 2019 for the Norwegian broadcaster NRK was a result of Disqus not knowing Norway had the GDPR (we are part of EEA, but not EU). Users are checked based on IP whether they come from a GDPR country. If GDPR, they will be put in private mode. A user needs to create a profile and consent to sharing for tracking to begin. Norwegian DPA opened an investigation as a result of our stories and Norwegians are now in private mode by default.

seanhunter 6y ago
Fair to say this is necessary but not sufficient. GDPR covers users within GDPR countries but also European data subjects wherever they are in the world.
- Daho0n 6y ago
  This gets repeated over and over on HN but it isn't true. I feel this is because so many try to make GDPR seem too hard and breaking everything (likely people with something to lose). GDPR is for data in the EU. That is it. Not data outside the EU and not people outside the EU. An American in the EU is covered, an EU citizen in the US is not. What you are saying would require that the EU could create laws that were above the Supreme Court in the US for example. It simply isn't true.
  - h_anna_h 6y ago
    > I feel this is because so many try to make GDPR seem too hard and breaking everything (likely people with something to lose). Or people who wish to extend the reach of GDPR so that others outside of the EU are protected too. > What you are saying would require that the EU could create laws that were above the Supreme Court in the US for example This is not true for multiple reasons. Check out https://en.wikipedia.org/wiki/PROTECT_Act_of_2003 https://en.wikipedia.org/wiki/PROTECT_Act_of_2003 specifically "Authorizes fines and/or imprisonment for up to 30 years for U.S. citizens or residents who engage in illicit sexual conduct abroad". The EU could punish US companies that have offices in the EU or income from the EU. Alternatively it could sanction them.
    - Daho0n 6y ago
      Let me rephrase: If the data is in the EU it is covered by GDPR no matter where the person that creates the data is at (yes in the US too) but the person isn't covered by the GDPR, the data (that is in the EU) is covered. It is not the same thing. What most people seem to think is the EU overreaching and "making laws that reach outsides its borders" is in cases where a foreign company (like Facebook) gets regulated by GDPR even though the company is outside the EU. This is because the data is in the EU and of course data in the EU isn't under US or any other entities law but EU (and member states). If you transfer data outside the EU you either do so illegally or have to follow the rules of the GDPR. It still doesn't reach outside the EU borders. Of course if you do something criminally the EU might judge you no matter where you are at just like the US with PROTECT Act of 2003 but that is another matter.
unicornporn 6y ago
Thanks for this!