5 ms·

Thanks. Only for the record, the message I get from EU: 451: Unavailable due to legal reasons We recognize you are attempting to access this website from a c

by jaclaz 5y ago

Thanks. Only for the record, the message I get from EU: 451: Unavailable due to legal reasons We recognize you are attempting to access this website from a country belonging to the European Economic Area (EEA) including the EU which enforces the General Data Protection Regulation (GDPR) and therefore access cannot be granted at this time. For any issues, contact help@purdueexponent.org or call 765-743-1111. Maybe it is just me, but the "therefore" is not consequential. AFAIK, if you don't gather data, you don't have to protect them, GDPR or not.

gorgoiler 5y ago
…on a page that makes a call to Google Tag Manager.
vesinisa 5y ago
Can't help seeing the irony that the censored document is a declaration by the publisher about how strongly they are committed to freedom of expression in international context.. CORRECTION: As other have pointed out, the publisher is actually the student newspaper, which is independent from Purdue University itself.
- jmull 5y ago
  The letter is from the president of Purdue, while the web site is a news site that is independent of the university. Also, it’s not really censorship — they have to deal with the GDPR headache, one way or the other, just like everyone else. Simply blocking the EU is a blunt but simple and effective way of doing so, and makes decent sense for a site where the interest is 99% local.
  - hdjjhhvvhga 5y ago
    > they have to deal with the GDPR headache What headache? A sensible solution: when EU visitor is detected, don't set cookies. Purdue solution: when EU visitor is detected, block them.
    - quartz 5y ago
      > What headache? A sensible solution: when EU visitor is detected, don't set cookies. The headache is convincing someone to pay a lawyer to agree that this is the solution when serving content to the EU is outside your publication's mission. Also: The Exponent isn't Purdue, it's independent. Purdue chose email as their publication medium.
      - hdjjhhvvhga 5y ago
        The GDPR is about personal data. It can get complex when you actually start to deal with personal data. You need to notify users, enable them to modify their data and so on. For many platforms this is already very easy or built in, for some like ERP systems it was quite complicated. Fortunately there exist a very simple solution: don't gather personal data. Note that it does not necessarily applies to cookies: they are considered personal data only if they can be used to identify the individual.[0] There is exactly zero chance anybody would go after you if you don't set cookies or set them for reasons other than making personal identification possible. [0] https://www.itgovernance.eu/blog/en/how-the-gdpr-affects-cookie-policies https://www.itgovernance.eu/blog/en/how-the-gdpr-affects-coo...
    - josefx 5y ago
      Not sure if that is enough. They seem to have facebook and twitter links and as far as I remember these usually come in a JavaScript spyware bundle and those are only the obvious ones.
    - mikewarot 5y ago
      >when EU visitor is detected, don't set cookies How do you know that somewhere in the stack of things the server is running isn't something that would set a cookie for some valid reason, and thus trigger the EU's stupid laws? A positive stop, the redirect to a text page, is far better than a hope and a prayer.
      - hdjjhhvvhga 5y ago
        Not setting cookies is a radical solution. Actually there is no problem with cookies at all unless they are being used to identify the individual. [0] So by definition any valid reason causes absolutely no problem. It is only if you decide that you want to deal with personally identifiable information, transfer it to third parties etc., it becomes problematic. People in the EU quickly learned not to do that and we're very happy about it. [0] https://www.itgovernance.eu/blog/en/how-the-gdpr-affects-cookie-policies https://www.itgovernance.eu/blog/en/how-the-gdpr-affects-coo...
- jaclaz 5y ago
  >Can't help seeing the irony that the censored document is a declaration by the publisher about how strongly they are committed to freedom of expression in international context.. Yep, and - also ironically - the root of publisher is the same as public, so you want to make something public but you restrict the access to a whole subset of the public. Besides that, if they had written (without recurring to http 451[0]) a simple message like: "We are sorry but we cannot serve this content due to the possible non-compliance of this site with EU Laws (GDPR)" it would have been (IMHO) much more correct/polite. I read the message "as is" more like: Hallo, stupid visitor from Europe, you are denied access to the contents because you voted stupid people that wrote stupid laws that we won't respect. The page served should be reachable even from non EU countries: https://www.purdueexponent.org/campus/article_aa3e67de-5de9-11ec-9246-af6384980cbb.html https://www.purdueexponent.org/campus/article_aa3e67de-5de9-... and it has some interesting html keywords in "base": <meta name="keywords" content="mitch, daniels, mitch daniels, purdue, central intelligence agency, chinese embassy, tiananmen square, zhihao kong"> <meta name="news_keywords" content="mitch, daniels, mitch daniels, purdue, central intelligence agency, chinese embassy, tiananmen square, zhihao kong"> [0] the example on Wikipedia is a good one: https://en.wikipedia.org/wiki/HTTP_451 https://en.wikipedia.org/wiki/HTTP_451
- outside1234 5y ago
  Also, they don't have the money to comply with the EU's GDPR from a legal requirement, so this is really a result of the EU's laws.
  - shuger 5y ago
    If you don't collect data on the visitors you don't need to do anything to comply.
    - deleted 5y ago
      [deleted]
teekert 5y ago
Indeed I interpret this as “they were going to extract much more data than needed”, but it could just be fear.
- mtberatwork 5y ago
  Based on their privacy policy, it's data extraction. Also for some reason they link out to privacy policies of the Walt Disney company and the Washington Post? They also seem to use some obscure, third party CMS provider, and perhaps the ads are handled by that organization? In either case, I'm not sure why a student run, university newspaper needs to have such predatory data practices.
- geoduck14 5y ago
  I saw it as the opposite- the website was exposing personal info about the man who was harassed.
tapoxi 5y ago
This website is an independent publication about Purdue, not Purdue itself. If you're small and running ads, I'm pretty sure you don't want to risk dealing with the significant legal pitfalls of GDPR. They EU isn't your audience, and lawyers that confirm you're in compliance (or not) are expensive.
- wizzwizz4 5y ago
  > They EU isn't your audience, and lawyers that confirm you're in compliance (or not) are expensive. The GDPR is one of the easiest pieces of legislation I've ever read. And the answer is: no, basically nobody is in compliance.
  - mcv 5y ago
    Everybody who doesn't collect personal data about their visitors is perfectly compliant.
    - wizzwizz4 5y ago
      Indeed.
      - trulyme 5y ago
        That's a bit of an exaggeration. Those that try to collect as much data as possible data from visitors will of course find it difficult to be compliant, but many do not do this and are therefore in compliance with GDPR. I do find the propaganda against GDPR annoying though. As an EU citizen (and someone who had to make sure we were compliant on multiple projects) I am happy about it. Is it perfect? No. But it's still waaaay better than nothing.
        wizzwizz4 5y ago
        > but many do not do this and are therefore in compliance with GDPR. Of the parts of the web I frequent? Sure. Most people will never leave the GDPR-violating web most months.
TrispusAttucks 5y ago
My guess is that there is not enough staff resources to ensure that all sites are compliant to the GDPR regulations so a blanket block of the EU was the most (only) cost effective solution to mitigate risk.
- gambiting 5y ago
  If they don't have user accounts and no ads then there's literally nothing to do to be GDPR compliant. Literally zero.
  - geoduck14 5y ago
    You need to NOT store IP addresses. And the hosters that provide you traffic need to also NOT store them
    - hdjjhhvvhga 5y ago
      You're kidding, right? I was hoping after so many years it's clear. GDPR is about personal information. First, if you have no way of linking the IP to personal information, it does not apply. Second, even if it's linked (as in a web store etc.), storing it is perfectly fine! You just need to clearly state what information you store and for how long. Everybody, also in the EU, are storing IP addresses. Everybody. Even the company who bragged they don't store logs for privacy reasons was caught storing them. It is important, it is necessary, and in many cases required by law.
      - mikewarot 5y ago
        Why risk getting entangled in weird foreign laws that might still have consequences here? The simplest solution is the best, just say no thanks in a simple redirect.
        hdjjhhvvhga 5y ago
        I understand why some people might be afraid of the risk. My point is that since you already implemented the code to detect EU customers, you could as well decide to not to set cookies rather than block them. In terms of complexity it's basically the same, but you get the benefit of increased exposure.
IncRnd 5y ago
People of the EU might want to seriously reconsider the GDPR after seeing its affects such as this.
- Rygian 5y ago
  As an European citizen, yes I am profoundly glad these effects exist. Error 418 means, to me, that the website is disappointed it cannot exploit my personal data without my consent. Good riddance.
  - catlikesshrimp 5y ago
    Honest question: How do you feel about your (i)phone being a permanent cookie? It aggregates all your information. Is anything being prepared for that?
    - forty 5y ago
      Note Gdpr is not only about cookies. It's about data collection. Being able to get and erase your personal data from any website is quite a nice feature.
    - Rygian 5y ago
      I contribute monthly to https://noyb.eu/ https://noyb.eu/ and am following their initiatives in that regard [1]. [1] https://noyb.eu/en/project/advertising-ids https://noyb.eu/en/project/advertising-ids
- rvense 5y ago
  Sites in the rest of the world might want to seriously reconsider their data collection practices after seeing its effects such as this.
- deleted 5y ago
  [deleted]
- gambiting 5y ago
  Quite the opposite! I'd much rather that the website denied me access than treated my private info like their own property purely because they are too lazy to be GDPR compliant.
BrandoElFollito 5y ago
If you are in the US without any foothold in the EU you should not care. I do not understand why these US-only sites care at all about EU. I am French so I do care very much about privacy, just do not understand these blocks.
dang 5y ago
We detached this subthread from https://news.ycombinator.com/item?id=29591781 https://news.ycombinator.com/item?id=29591781. I did that so the latter could be pinned to the top of the thread without being offtopic.

by jaclaz 5y ago

gorgoiler 5y ago

…on a page that makes a call to Google Tag Manager.

vesinisa 5y ago

Can't help seeing the irony that the censored document is a declaration by the publisher about how strongly they are committed to freedom of expression in international context.. CORRECTION: As other have pointed out, the publisher is actually the student newspaper, which is independent from Purdue University itself.

jmull 5y ago
The letter is from the president of Purdue, while the web site is a news site that is independent of the university. Also, it’s not really censorship — they have to deal with the GDPR headache, one way or the other, just like everyone else. Simply blocking the EU is a blunt but simple and effective way of doing so, and makes decent sense for a site where the interest is 99% local.
- hdjjhhvvhga 5y ago
  > they have to deal with the GDPR headache What headache? A sensible solution: when EU visitor is detected, don't set cookies. Purdue solution: when EU visitor is detected, block them.
  - quartz 5y ago
    > What headache? A sensible solution: when EU visitor is detected, don't set cookies. The headache is convincing someone to pay a lawyer to agree that this is the solution when serving content to the EU is outside your publication's mission. Also: The Exponent isn't Purdue, it's independent. Purdue chose email as their publication medium.
    - hdjjhhvvhga 5y ago
      The GDPR is about personal data. It can get complex when you actually start to deal with personal data. You need to notify users, enable them to modify their data and so on. For many platforms this is already very easy or built in, for some like ERP systems it was quite complicated. Fortunately there exist a very simple solution: don't gather personal data. Note that it does not necessarily applies to cookies: they are considered personal data only if they can be used to identify the individual.[0] There is exactly zero chance anybody would go after you if you don't set cookies or set them for reasons other than making personal identification possible. [0] https://www.itgovernance.eu/blog/en/how-the-gdpr-affects-cookie-policies https://www.itgovernance.eu/blog/en/how-the-gdpr-affects-coo...
  - josefx 5y ago
    Not sure if that is enough. They seem to have facebook and twitter links and as far as I remember these usually come in a JavaScript spyware bundle and those are only the obvious ones.
  - mikewarot 5y ago
    >when EU visitor is detected, don't set cookies How do you know that somewhere in the stack of things the server is running isn't something that would set a cookie for some valid reason, and thus trigger the EU's stupid laws? A positive stop, the redirect to a text page, is far better than a hope and a prayer.
    - hdjjhhvvhga 5y ago
      Not setting cookies is a radical solution. Actually there is no problem with cookies at all unless they are being used to identify the individual. [0] So by definition any valid reason causes absolutely no problem. It is only if you decide that you want to deal with personally identifiable information, transfer it to third parties etc., it becomes problematic. People in the EU quickly learned not to do that and we're very happy about it. [0] https://www.itgovernance.eu/blog/en/how-the-gdpr-affects-cookie-policies https://www.itgovernance.eu/blog/en/how-the-gdpr-affects-coo...
jaclaz 5y ago
>Can't help seeing the irony that the censored document is a declaration by the publisher about how strongly they are committed to freedom of expression in international context.. Yep, and - also ironically - the root of publisher is the same as public, so you want to make something public but you restrict the access to a whole subset of the public. Besides that, if they had written (without recurring to http 451[0]) a simple message like: "We are sorry but we cannot serve this content due to the possible non-compliance of this site with EU Laws (GDPR)" it would have been (IMHO) much more correct/polite. I read the message "as is" more like: Hallo, stupid visitor from Europe, you are denied access to the contents because you voted stupid people that wrote stupid laws that we won't respect. The page served should be reachable even from non EU countries: https://www.purdueexponent.org/campus/article_aa3e67de-5de9-11ec-9246-af6384980cbb.html https://www.purdueexponent.org/campus/article_aa3e67de-5de9-... and it has some interesting html keywords in "base": <meta name="keywords" content="mitch, daniels, mitch daniels, purdue, central intelligence agency, chinese embassy, tiananmen square, zhihao kong"> <meta name="news_keywords" content="mitch, daniels, mitch daniels, purdue, central intelligence agency, chinese embassy, tiananmen square, zhihao kong"> [0] the example on Wikipedia is a good one: https://en.wikipedia.org/wiki/HTTP_451 https://en.wikipedia.org/wiki/HTTP_451
outside1234 5y ago
Also, they don't have the money to comply with the EU's GDPR from a legal requirement, so this is really a result of the EU's laws.
- shuger 5y ago
  If you don't collect data on the visitors you don't need to do anything to comply.
  - deleted 5y ago
    [deleted]

teekert 5y ago

Indeed I interpret this as “they were going to extract much more data than needed”, but it could just be fear.

mtberatwork 5y ago
Based on their privacy policy, it's data extraction. Also for some reason they link out to privacy policies of the Walt Disney company and the Washington Post? They also seem to use some obscure, third party CMS provider, and perhaps the ads are handled by that organization? In either case, I'm not sure why a student run, university newspaper needs to have such predatory data practices.
geoduck14 5y ago
I saw it as the opposite- the website was exposing personal info about the man who was harassed.

tapoxi 5y ago

This website is an independent publication about Purdue, not Purdue itself. If you're small and running ads, I'm pretty sure you don't want to risk dealing with the significant legal pitfalls of GDPR. They EU isn't your audience, and lawyers that confirm you're in compliance (or not) are expensive.

wizzwizz4 5y ago
> They EU isn't your audience, and lawyers that confirm you're in compliance (or not) are expensive. The GDPR is one of the easiest pieces of legislation I've ever read. And the answer is: no, basically nobody is in compliance.
- mcv 5y ago
  Everybody who doesn't collect personal data about their visitors is perfectly compliant.
  - wizzwizz4 5y ago
    Indeed.
    - trulyme 5y ago
      That's a bit of an exaggeration. Those that try to collect as much data as possible data from visitors will of course find it difficult to be compliant, but many do not do this and are therefore in compliance with GDPR. I do find the propaganda against GDPR annoying though. As an EU citizen (and someone who had to make sure we were compliant on multiple projects) I am happy about it. Is it perfect? No. But it's still waaaay better than nothing.
      - wizzwizz4 5y ago
        > but many do not do this and are therefore in compliance with GDPR. Of the parts of the web I frequent? Sure. Most people will never leave the GDPR-violating web most months.

TrispusAttucks 5y ago

My guess is that there is not enough staff resources to ensure that all sites are compliant to the GDPR regulations so a blanket block of the EU was the most (only) cost effective solution to mitigate risk.

gambiting 5y ago
If they don't have user accounts and no ads then there's literally nothing to do to be GDPR compliant. Literally zero.
- geoduck14 5y ago
  You need to NOT store IP addresses. And the hosters that provide you traffic need to also NOT store them
  - hdjjhhvvhga 5y ago
    You're kidding, right? I was hoping after so many years it's clear. GDPR is about personal information. First, if you have no way of linking the IP to personal information, it does not apply. Second, even if it's linked (as in a web store etc.), storing it is perfectly fine! You just need to clearly state what information you store and for how long. Everybody, also in the EU, are storing IP addresses. Everybody. Even the company who bragged they don't store logs for privacy reasons was caught storing them. It is important, it is necessary, and in many cases required by law.
    - mikewarot 5y ago
      Why risk getting entangled in weird foreign laws that might still have consequences here? The simplest solution is the best, just say no thanks in a simple redirect.
      - hdjjhhvvhga 5y ago
        I understand why some people might be afraid of the risk. My point is that since you already implemented the code to detect EU customers, you could as well decide to not to set cookies rather than block them. In terms of complexity it's basically the same, but you get the benefit of increased exposure.

IncRnd 5y ago

People of the EU might want to seriously reconsider the GDPR after seeing its affects such as this.

Rygian 5y ago
As an European citizen, yes I am profoundly glad these effects exist. Error 418 means, to me, that the website is disappointed it cannot exploit my personal data without my consent. Good riddance.
- catlikesshrimp 5y ago
  Honest question: How do you feel about your (i)phone being a permanent cookie? It aggregates all your information. Is anything being prepared for that?
  - forty 5y ago
    Note Gdpr is not only about cookies. It's about data collection. Being able to get and erase your personal data from any website is quite a nice feature.
  - Rygian 5y ago
    I contribute monthly to https://noyb.eu/ https://noyb.eu/ and am following their initiatives in that regard [1]. [1] https://noyb.eu/en/project/advertising-ids https://noyb.eu/en/project/advertising-ids
rvense 5y ago
Sites in the rest of the world might want to seriously reconsider their data collection practices after seeing its effects such as this.
deleted 5y ago
[deleted]
gambiting 5y ago
Quite the opposite! I'd much rather that the website denied me access than treated my private info like their own property purely because they are too lazy to be GDPR compliant.

BrandoElFollito 5y ago

If you are in the US without any foothold in the EU you should not care. I do not understand why these US-only sites care at all about EU. I am French so I do care very much about privacy, just do not understand these blocks.

dang 5y ago

We detached this subthread from https://news.ycombinator.com/item?id=29591781 https://news.ycombinator.com/item?id=29591781. I did that so the latter could be pinned to the top of the thread without being offtopic.