3 ms·

How? The data stays in EU. Routing to US is clearly a bug (that violates it, yes)

by klohto 5y ago

djrogers 5y ago
Doubt it violates anything - the packets may route through a US based relay, but they’re encrypted when they do, and don’t expose any data. The very nature of the internet makes it impossible to guarantee that none of your packets ever route through a specific country (especially one as connected as the US).
- donohoe 5y ago
  I didn’t say it violates it - it does not. I meant that most consent systems that companies add to their site to determine if a user is in EU or not (and hence covered by GDPR) won’t work reliable with Apple users. Most of their geolocation relies on IP addresses.
  - djrogers 5y ago
    I was replying to my posts parent who brought up the word violate, not your post.
- netr0ute 5y ago
  > makes it impossible to guarantee that none of your packets ever route through a specific country Technically untrue, since you can add "strict source routing" as an IP packet option that specifies exactly where it will be routed.
  - djrogers 5y ago
    Nope, you can’t actually do that on the internet at large. Yes, the RFC exists, but your ISP and their upstream will often ignore or even drop those packets. Also, SSR doesn’t involve geography - IPs and ASNs can move.
donohoe 5y ago
No, I mean detection systems that trigger consent. Most systems look at IP address to determine if you are an EU user, then give you consent options. Now there there is no reliable way to tell
- nybble41 5y ago
  It's not as if IP addresses were ever a reliable way to tell whether a data subject was physically located within the EU. VPNs and proxies have been around forever. Someone could be accessing your site through Tor Browser or I2P while located in the EU—and if so, these are the users who would be most interested in limiting processing of their personal data. Just assume that no consent is granted. Access to the site or specific services cannot depend on granting consent, which implies that anyone who does grant consent probably failed to understand that it was optional, or did so only to avoid being harassed with further consent requests. The GDPR already makes the "consent" completely one-sided with no possibility of consideration; it might as well have disallowed the requests altogether and saved everyone a great deal of hassle.

How? The data stays in EU. Routing to US is clearly a bug (that violates it, yes)

by klohto 5y ago

How? The data stays in EU. Routing to US is clearly a bug (that violates it, yes)

Doubt it violates anything - the packets may route through a US based relay, but they’re encrypted when they do, and don’t expose any data. The very nature of the internet makes it impossible to guarantee that none of your packets ever route through a specific country (especially one as connected as the US).

donohoe 5y ago
I didn’t say it violates it - it does not. I meant that most consent systems that companies add to their site to determine if a user is in EU or not (and hence covered by GDPR) won’t work reliable with Apple users. Most of their geolocation relies on IP addresses.
- djrogers 5y ago
  I was replying to my posts parent who brought up the word violate, not your post.
netr0ute 5y ago
> makes it impossible to guarantee that none of your packets ever route through a specific country Technically untrue, since you can add "strict source routing" as an IP packet option that specifies exactly where it will be routed.
- djrogers 5y ago
  Nope, you can’t actually do that on the internet at large. Yes, the RFC exists, but your ISP and their upstream will often ignore or even drop those packets. Also, SSR doesn’t involve geography - IPs and ASNs can move.

donohoe 5y ago

No, I mean detection systems that trigger consent. Most systems look at IP address to determine if you are an EU user, then give you consent options. Now there there is no reliable way to tell

nybble41 5y ago
It's not as if IP addresses were ever a reliable way to tell whether a data subject was physically located within the EU. VPNs and proxies have been around forever. Someone could be accessing your site through Tor Browser or I2P while located in the EU—and if so, these are the users who would be most interested in limiting processing of their personal data. Just assume that no consent is granted. Access to the site or specific services cannot depend on granting consent, which implies that anyone who does grant consent probably failed to understand that it was optional, or did so only to avoid being harassed with further consent requests. The GDPR already makes the "consent" completely one-sided with no possibility of consideration; it might as well have disallowed the requests altogether and saved everyone a great deal of hassle.