4 ms·

If you wanted to ensure that only companies with the resources of FAAMG could operate in your jurisdiction, you could hardly do better than the EU has done.

Jensson 5y ago
I still see plenty of small companies operating online in the country I live in. GDPR isn't particularly hard or expensive to follow if you are small and barely have any data, especially if you build your system to be GDPR compliant from the start. The expensive part comes when you are already large and have to make that large system GDPR compliant after it is already built.
- systemvoltage 5y ago
  As a consumer, all I got for GDPR is a lipservice in the form of cookie banners and annoyance everywhere on the web.
  - sharken 5y ago
    Exactly, cookie banners are an annoyance where the user ends up clicking Accept All just to make the banner go away.
  - Jensson 5y ago
    You got the ability to demand to see your data from every company and get it deleted, you didn't have that before. They could just keep whatever data they want and there is nothing you could do to discover or stop them from doing that. If you care about privacy at all you should be very happy that is possible today. It is how we got all those articles showing what data Google and all other companies collects about you, since they asked about this referring to this EU law and the companies has to comply. So even if you don't use it yourself it greatly helps you anyway.
    - systemvoltage 5y ago
      I can see this useful for sites that collect a lot of data (Banks, Social Media, etc.) but for buying shoes from a shopify website, I really don't give a shit. If anything, GDPR has been a nuissance to me as a consumer. Being 100% honest. Cookier banners are so ubiquitious that we've all gotten used to just accepting them and moving on. This is the problem with EU regulation. Good intentions, bad implementations and unforeseen consequences. In fact this goes so far into the reasons why EU cannot harbor a growing startup scene or make rockets. I am not against regulations but if you lay a landmind in front of every endeavor in the form of regulations, it bears down on people that want to disrupt existing and overweight companies that can afford to abide by regulations. I've talked to many Europeans and they resonate with the same sentiments. I own a small business and I've gone through the process GDPR compliance. It is not too bad but there is a reason why there are upteen number of GDPR compliance consulting firms and checklist makers out there. What should have happened is a complete solution to privacy in the browser instead of playing cat and mouse games with businesses that will find loop holes.
      - Jensson 5y ago
        > Cookier banners are so ubiquitious that we've all gotten used to just accepting them and moving on. Cookie banners has nothing to do with GDPR. > I own a small business and I've gone through the process GDPR compliance. It is not too bad but there is a reason why there are upteen number of GDPR compliance consulting firms and checklist makers out there. The reason is that GDPR compliance gets more expensive the more technical debt you have. For big enough companies with bad engineering practices it can costs hundreds of millions of dollars. For a small business with a straightforward product they likely are all but compliant without even trying. > What should have happened is a complete solution to privacy in the browser instead of playing cat and mouse games with businesses that will find loop holes. GDPR has nothing to do with browsers, it has to do with forcing companies to ask for and track data they keep on you no matter where it comes from. It applies to apps, to hiring interviews, to storing transaction data when you buy groceries etc. What you are talking about is a completely different issue.
        5y ago
- sharken 5y ago
  For larger companies i can tell you that the red tape and additional overhead from GDPR is horribly expensive to implement. Not to mention the reduced happiness from working with GDPR. If Google could help remove GDPR and the Cookie law i would welcome it.
  - Jensson 5y ago
    I am really happy that EU forces you to properly track what and where you store data about users. Sloppily just storing data everywhere and not properly deleting it is a huge security/privacy hazard, making such reckless behaviour illegal is a great thing.
  - Cipater 5y ago
    >Not to mention the reduced happiness from working with GDPR. I'm of the opinion it should be even more onerous to deal with people's data than it currently is. GPDR doesn't go far enough.
  - csydas 5y ago
    >For larger companies i can tell you that the red tape and additional overhead from GDPR is horribly expensive to implement. My company had about a week of design of our data handling infographic and policy page and that was it for GDPR. The transition was incredibly simple, as we just didn't keep such data in the first place. Because we did collect voluntarily submitted items from users which might contain such protected data, we simply explained our retention process to users and documented in full the data's life-cycle once it hit our servers. I think we had to add a few extra S3 regions for uploads also, but that was just a few clicks. GDPR is anything but a headache unless you're trying to do the things the GDPR doesn't want you to be doing; then yeah, it's probably quite a headache.
12baad4db82 5y ago
I think you are spot on, but maybe for a different reason. The EU has looked at the practices of large tech companies in the USA and decided that the way that these companies are collecting personal information and selling it for profit is something that should be progressively phased out. So not being able to create a company that harvests personal data seems like a win for the GDPR. The next step would be to reign in the large companies that have been able to use their resources to continue the practices that the GDPR has set out to limit. As a side point, I work in a tech startup in the EU that was founded post GDPR. We have no issues being competitive and also complying with the GDPR, however we do not make our revenue by selling personal data.
azalemeth 5y ago
The thing I noticed most is that in Denmark, Danish sites follow both the letter and thespirit of GDPR. I was looking at trying to pay my electricity bill the other night and got told that because my version of FF sent the Do Not Track header, they'd automatically "objected" to all cookies and branding beyond necessary ones and I didn't need to do anything else. Those big banners have a simple "yes to only necessary" or "yes to all" button at the bottom. American sites on the other hand tell me either "tough, take our spyware if you want to see this site, or to to a restricted list of five pages" (which I'm pretty sure isn't legal under GDPR); throw up the gauntlet of 1000 tick-boxes, infinitely nested, or say "you're from the EU and we can't serve you page". The problem is cultural. I've de-googled myself as much as possible, but I don't like the fact that all of my real mobile device choices are written in California and made in china.
- azeirah 5y ago
  Samsung is neither Chinese nor Californian. Their phones are designed in south korea and manufactured in South korea, indonesia and brazil.
  - onedognight 5y ago
    The GP’s point was that Android/G-Suite/Firmware, the software on Samsung phones, is substantially “written in California”. That seems true enough in spirit.
- thawSeh6s2p 5y ago
  Almost every site has the "Yes to necessary" or "yes to all" now, it's not in the banner but generally IME if I click the "select" option it automatically has all the "optional" cookies turned off. Just two clicks instead of one. I think since the majority of people are too lazy for two clicks they see "select which ones", say whatever and just accept all so hiding the fact you don't actually have to select works in the site's favor.
ausbah 5y ago
I've heard this a lot on HN, any data to back it up?

Jensson 5y ago

I still see plenty of small companies operating online in the country I live in. GDPR isn't particularly hard or expensive to follow if you are small and barely have any data, especially if you build your system to be GDPR compliant from the start. The expensive part comes when you are already large and have to make that large system GDPR compliant after it is already built.

systemvoltage 5y ago
As a consumer, all I got for GDPR is a lipservice in the form of cookie banners and annoyance everywhere on the web.
- sharken 5y ago
  Exactly, cookie banners are an annoyance where the user ends up clicking Accept All just to make the banner go away.
- Jensson 5y ago
  You got the ability to demand to see your data from every company and get it deleted, you didn't have that before. They could just keep whatever data they want and there is nothing you could do to discover or stop them from doing that. If you care about privacy at all you should be very happy that is possible today. It is how we got all those articles showing what data Google and all other companies collects about you, since they asked about this referring to this EU law and the companies has to comply. So even if you don't use it yourself it greatly helps you anyway.
  - systemvoltage 5y ago
    I can see this useful for sites that collect a lot of data (Banks, Social Media, etc.) but for buying shoes from a shopify website, I really don't give a shit. If anything, GDPR has been a nuissance to me as a consumer. Being 100% honest. Cookier banners are so ubiquitious that we've all gotten used to just accepting them and moving on. This is the problem with EU regulation. Good intentions, bad implementations and unforeseen consequences. In fact this goes so far into the reasons why EU cannot harbor a growing startup scene or make rockets. I am not against regulations but if you lay a landmind in front of every endeavor in the form of regulations, it bears down on people that want to disrupt existing and overweight companies that can afford to abide by regulations. I've talked to many Europeans and they resonate with the same sentiments. I own a small business and I've gone through the process GDPR compliance. It is not too bad but there is a reason why there are upteen number of GDPR compliance consulting firms and checklist makers out there. What should have happened is a complete solution to privacy in the browser instead of playing cat and mouse games with businesses that will find loop holes.
    - Jensson 5y ago
      > Cookier banners are so ubiquitious that we've all gotten used to just accepting them and moving on. Cookie banners has nothing to do with GDPR. > I own a small business and I've gone through the process GDPR compliance. It is not too bad but there is a reason why there are upteen number of GDPR compliance consulting firms and checklist makers out there. The reason is that GDPR compliance gets more expensive the more technical debt you have. For big enough companies with bad engineering practices it can costs hundreds of millions of dollars. For a small business with a straightforward product they likely are all but compliant without even trying. > What should have happened is a complete solution to privacy in the browser instead of playing cat and mouse games with businesses that will find loop holes. GDPR has nothing to do with browsers, it has to do with forcing companies to ask for and track data they keep on you no matter where it comes from. It applies to apps, to hiring interviews, to storing transaction data when you buy groceries etc. What you are talking about is a completely different issue.
      - 5y ago
sharken 5y ago
For larger companies i can tell you that the red tape and additional overhead from GDPR is horribly expensive to implement. Not to mention the reduced happiness from working with GDPR. If Google could help remove GDPR and the Cookie law i would welcome it.
- Jensson 5y ago
  I am really happy that EU forces you to properly track what and where you store data about users. Sloppily just storing data everywhere and not properly deleting it is a huge security/privacy hazard, making such reckless behaviour illegal is a great thing.
- Cipater 5y ago
  >Not to mention the reduced happiness from working with GDPR. I'm of the opinion it should be even more onerous to deal with people's data than it currently is. GPDR doesn't go far enough.
- csydas 5y ago
  >For larger companies i can tell you that the red tape and additional overhead from GDPR is horribly expensive to implement. My company had about a week of design of our data handling infographic and policy page and that was it for GDPR. The transition was incredibly simple, as we just didn't keep such data in the first place. Because we did collect voluntarily submitted items from users which might contain such protected data, we simply explained our retention process to users and documented in full the data's life-cycle once it hit our servers. I think we had to add a few extra S3 regions for uploads also, but that was just a few clicks. GDPR is anything but a headache unless you're trying to do the things the GDPR doesn't want you to be doing; then yeah, it's probably quite a headache.

12baad4db82 5y ago

I think you are spot on, but maybe for a different reason. The EU has looked at the practices of large tech companies in the USA and decided that the way that these companies are collecting personal information and selling it for profit is something that should be progressively phased out. So not being able to create a company that harvests personal data seems like a win for the GDPR. The next step would be to reign in the large companies that have been able to use their resources to continue the practices that the GDPR has set out to limit. As a side point, I work in a tech startup in the EU that was founded post GDPR. We have no issues being competitive and also complying with the GDPR, however we do not make our revenue by selling personal data.

azalemeth 5y ago

The thing I noticed most is that in Denmark, Danish sites follow both the letter and thespirit of GDPR. I was looking at trying to pay my electricity bill the other night and got told that because my version of FF sent the Do Not Track header, they'd automatically "objected" to all cookies and branding beyond necessary ones and I didn't need to do anything else. Those big banners have a simple "yes to only necessary" or "yes to all" button at the bottom. American sites on the other hand tell me either "tough, take our spyware if you want to see this site, or to to a restricted list of five pages" (which I'm pretty sure isn't legal under GDPR); throw up the gauntlet of 1000 tick-boxes, infinitely nested, or say "you're from the EU and we can't serve you page". The problem is cultural. I've de-googled myself as much as possible, but I don't like the fact that all of my real mobile device choices are written in California and made in china.

azeirah 5y ago
Samsung is neither Chinese nor Californian. Their phones are designed in south korea and manufactured in South korea, indonesia and brazil.
- onedognight 5y ago
  The GP’s point was that Android/G-Suite/Firmware, the software on Samsung phones, is substantially “written in California”. That seems true enough in spirit.
thawSeh6s2p 5y ago
Almost every site has the "Yes to necessary" or "yes to all" now, it's not in the banner but generally IME if I click the "select" option it automatically has all the "optional" cookies turned off. Just two clicks instead of one. I think since the majority of people are too lazy for two clicks they see "select which ones", say whatever and just accept all so hiding the fact you don't actually have to select works in the site's favor.

ausbah 5y ago

I've heard this a lot on HN, any data to back it up?