4 ms·

> Motivation: Lately due to GDPR many websites are blocking access in the EU. For me, I cannot order medicines back home via netmeds.com Blaming GDPR for this

> Motivation: Lately due to GDPR many websites are blocking access in the EU. For me, I cannot order medicines back home via netmeds.com Blaming GDPR for this is a bit like blaming a lead mine for getting shot. Yes, it's involved but it's not the reason. It only seems to be certain large US websites that carte-blanch refuse to serve EU visitors over GDPR, mostly those with large, tendril-filled advertising networks that have no "easy opt-out". Some sites (healthcare ones that tended to be SEO'd to the max when I searched for drug names as well as more mainstream ones like, iirc, the Washington Post) carte-blanch refuse to let you browse them without accepting unnecessary cookies; this is a direct breach of the legislation and yet they still want your traffic. If someone won't sell you something because of GDPR -- legislation that protects your privacy, and in particular considers medical information as especially sensitive -- then you perhaps have to think rather carefully about if you wish to do business with them. (For what it's worth, from a Danish IP, the site listed in the github repo works perfectly on my home network which admittedly contains a pihole-provided dns-level adblocking. It blocks tor and I don't have an easy way of testing it otherwise).

mosseater 5y ago
On the other side of this, depending on the breadth of your data, it can be non trivial to run pipelines to redact someones information. It takes man hours to verify, and processing time ($$). Plus, what if they don't have that process in place? They will need to do it manually, and take up more time from someone. Plus you need to communicate with the requestee and verify their identity as well as give them updates when they ask. This is fine if not abused. But if a mountain of redactions came in, I could see a company just deciding it wasn't worth it to serve the EU. Not to mention the fact that there are a non-zero amount of people that will make GDPR redaction requests and hound the company down in hopes of suing them if they don't follow the law to the letter and/or can't process the redaction in time. If a company doesn't already have that process in place, it could be a momentous task to initially process. I'm 100% for user privacy. But it can be tricky with the way the GDPR law works, so I understand why companies outside of the EU don't bother with it.
- dinvlad 5y ago
  I think in CVS's case likely yes, they probably hired underpaid folks to implement their site, and now those folks are probably long gone so no one would even know how to remove all those advertising domains without which the site doesn't work.
- mindslight 5y ago
  There are two easy answers for this: 1. Don't create surveillance files on people in the first place. It's not like the lack of privacy legislation means there are legitimate reasons to be performing surveillance. It's just that the illegitimate ones have not yet been made illegal. 2. US states should start adopting the GDPR verbatim (with no corpocratic handouts), so there is only one law to follow.
canadaduane 5y ago
> perhaps have to think rather carefully about if you wish to do business with them This seems to be precisely what happened--and the thinking involved invention--a way of circumventing what prevented acquiring the needed medication. (I assume that alternatives were considered, and found wanting for one reason or another).
dinvlad 5y ago
Well, this reminded me of the situation right here in the US. The other day I couldn't place an online order at CVS because it was repeatedly "having technical difficulties". Turns out I had to unblock half a dozen (!) advertising domains in my Pihole (incl. the ones I've never heard of) to finally place an order. I don't know how to treat it as "I have a choice whether to do business with them" ;-) I guess the only way to protect my privacy in this case is to risk going to the physical store with other sick people atm.
- mindslight 5y ago
  I handle this pragmatically by using different VMs with assorted browsers, browser configs, and exit addresses. For the context of buying from CVS (realworld nym, heavy surveillance), I'm running NoScript and slowly enable domains until the site works. Doing this for some sites actually speeds them up considerably (eg Home Depot).
  - dinvlad 5y ago
    The problem is in this case, no amount of blocking will work, because the site was completely broken without those, at least for me :-) Though I can reduce the amount of divulged info for sure, but the very fact they're using them means my order details likely go to third-parties, and it's impossible to prevent that because it relies on that reporting in the chain of logic (i.e. order won't proceed until a successful response from the advertising APIs). The only technical way around that I can think of is to implement Signal's and other's API proxies and let it return back fake info to the site. But I'm not that obsessed about this issue :-) Another over-the-top way is to place the order directly against CVS APIs, using their cookies etc. Again, not worth spending time on..
    - TedDoesntTalk 5y ago
      Why not just avoid CVS and use another pharmacy (online ordering). I use valisure because they also test the medications they sell for impurities, but there are plenty of others… like even supermarket pharmacies have online ordering now with home delivery or pickup.
syshum 5y ago
Business and people will take the path of least resistance. If only a small part of my traffic / business comes from the EU yet I am going to incur huge costs, and have to fundamentally change the way my business runs to comply with GDPR guess what, the EU is getting blocked, as make not sense to do it. My current company does not really collect user info, does no business at all in the EU or is even consumer facing in the US but looking at our internal processes it would be almost impossible to comply with GDPR with out changing MASSIVE amounts of internal processes and procedures.
- smoyer 5y ago
  And circumventing that block violates the CCFA (at least here in the US) so instead of the GDPR turning me into a criminal, SO users who visit my site are the ones violating the law.
- goodpoint 5y ago
  > Business and people will take the path of least resistance. No, this is malicious compliance.
tzs 5y ago
If a non-EU site finds itself subject to GDPR because of Article 3(2), they need to then worry about whether or not Article 27(2) applies to excuse them from Article 27(1). If not then they have to deal with the hassle and expense of hiring a representative in the Union. If they are indifferent to EU visitors but happen to get enough of them that 27(2) won't excuse them from 27(1), then it may be worth blocking EU visitors to try to reduce the chances that 3(2) applies. Article 3(2) is somewhat objecting, relying on whether you intended or not to offer goods or services to people in the Union so blocking is a way to make your intent clear. IP addresses are considered to be personal data under GDPR, so a site that is doing nothing other than serving content with no advertising or targeting but that has the default Apache logging enabled could end up with an Article 27 obligation.
- sokoloff 5y ago
  Just reading this comment makes me inclined to block visitors from the EU from my hobby sites. (Work is compliant; hobby/personal stuff isn’t worth the bother of even reading what Article 3(2) is.)
  - andai 5y ago
    I feel the same, and I live in the EU. The silver lining of my aversion to collecting user data is that it aligns nicely with my beliefs about privacy and minimalism (ie. coming up with ideas for web applications that don't even need a backend).
  - tzs 5y ago
    Article 3(2) is short. Here it is: > 2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: > (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or > (b) the monitoring of their behaviour as far as their behaviour takes place within the Union. Recital 23 includes an elaboration on (a): > In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union. Probably nothing to worry about for a hobby site.
ctime 5y ago
To be fair, both of the sites he mentioned are Indian (netmeds.com and makemytrip.com) I’m sure there are sites in the US, however, that block access from GDPR countries.
arihant 5y ago
Is there a study on comparing number of people actually selecting cookies on the pop ups vs. number of users who already had Adblock? Because unless you have that info, GDPR cannot be claimed to protect any privacy. How many people who never had Adblock are selecting which cookies they want on these pop ups? And it’s not only the US websites, the website OP mentioned is one of the three largest medicine websites in India. There is no reason for them to comply. And EU laws are incredibly confusing. Follow GDPR and respect privacy, while saving customer IP address for years when EU needs VAT.

mosseater 5y ago

On the other side of this, depending on the breadth of your data, it can be non trivial to run pipelines to redact someones information. It takes man hours to verify, and processing time ($$). Plus, what if they don't have that process in place? They will need to do it manually, and take up more time from someone. Plus you need to communicate with the requestee and verify their identity as well as give them updates when they ask. This is fine if not abused. But if a mountain of redactions came in, I could see a company just deciding it wasn't worth it to serve the EU. Not to mention the fact that there are a non-zero amount of people that will make GDPR redaction requests and hound the company down in hopes of suing them if they don't follow the law to the letter and/or can't process the redaction in time. If a company doesn't already have that process in place, it could be a momentous task to initially process. I'm 100% for user privacy. But it can be tricky with the way the GDPR law works, so I understand why companies outside of the EU don't bother with it.

dinvlad 5y ago
I think in CVS's case likely yes, they probably hired underpaid folks to implement their site, and now those folks are probably long gone so no one would even know how to remove all those advertising domains without which the site doesn't work.
mindslight 5y ago
There are two easy answers for this: 1. Don't create surveillance files on people in the first place. It's not like the lack of privacy legislation means there are legitimate reasons to be performing surveillance. It's just that the illegitimate ones have not yet been made illegal. 2. US states should start adopting the GDPR verbatim (with no corpocratic handouts), so there is only one law to follow.

canadaduane 5y ago

> perhaps have to think rather carefully about if you wish to do business with them This seems to be precisely what happened--and the thinking involved invention--a way of circumventing what prevented acquiring the needed medication. (I assume that alternatives were considered, and found wanting for one reason or another).

dinvlad 5y ago

Well, this reminded me of the situation right here in the US. The other day I couldn't place an online order at CVS because it was repeatedly "having technical difficulties". Turns out I had to unblock half a dozen (!) advertising domains in my Pihole (incl. the ones I've never heard of) to finally place an order. I don't know how to treat it as "I have a choice whether to do business with them" ;-) I guess the only way to protect my privacy in this case is to risk going to the physical store with other sick people atm.

mindslight 5y ago
I handle this pragmatically by using different VMs with assorted browsers, browser configs, and exit addresses. For the context of buying from CVS (realworld nym, heavy surveillance), I'm running NoScript and slowly enable domains until the site works. Doing this for some sites actually speeds them up considerably (eg Home Depot).
- dinvlad 5y ago
  The problem is in this case, no amount of blocking will work, because the site was completely broken without those, at least for me :-) Though I can reduce the amount of divulged info for sure, but the very fact they're using them means my order details likely go to third-parties, and it's impossible to prevent that because it relies on that reporting in the chain of logic (i.e. order won't proceed until a successful response from the advertising APIs). The only technical way around that I can think of is to implement Signal's and other's API proxies and let it return back fake info to the site. But I'm not that obsessed about this issue :-) Another over-the-top way is to place the order directly against CVS APIs, using their cookies etc. Again, not worth spending time on..
  - TedDoesntTalk 5y ago
    Why not just avoid CVS and use another pharmacy (online ordering). I use valisure because they also test the medications they sell for impurities, but there are plenty of others… like even supermarket pharmacies have online ordering now with home delivery or pickup.

syshum 5y ago

Business and people will take the path of least resistance. If only a small part of my traffic / business comes from the EU yet I am going to incur huge costs, and have to fundamentally change the way my business runs to comply with GDPR guess what, the EU is getting blocked, as make not sense to do it. My current company does not really collect user info, does no business at all in the EU or is even consumer facing in the US but looking at our internal processes it would be almost impossible to comply with GDPR with out changing MASSIVE amounts of internal processes and procedures.

smoyer 5y ago
And circumventing that block violates the CCFA (at least here in the US) so instead of the GDPR turning me into a criminal, SO users who visit my site are the ones violating the law.
goodpoint 5y ago
> Business and people will take the path of least resistance. No, this is malicious compliance.

tzs 5y ago

If a non-EU site finds itself subject to GDPR because of Article 3(2), they need to then worry about whether or not Article 27(2) applies to excuse them from Article 27(1). If not then they have to deal with the hassle and expense of hiring a representative in the Union. If they are indifferent to EU visitors but happen to get enough of them that 27(2) won't excuse them from 27(1), then it may be worth blocking EU visitors to try to reduce the chances that 3(2) applies. Article 3(2) is somewhat objecting, relying on whether you intended or not to offer goods or services to people in the Union so blocking is a way to make your intent clear. IP addresses are considered to be personal data under GDPR, so a site that is doing nothing other than serving content with no advertising or targeting but that has the default Apache logging enabled could end up with an Article 27 obligation.

sokoloff 5y ago
Just reading this comment makes me inclined to block visitors from the EU from my hobby sites. (Work is compliant; hobby/personal stuff isn’t worth the bother of even reading what Article 3(2) is.)
- andai 5y ago
  I feel the same, and I live in the EU. The silver lining of my aversion to collecting user data is that it aligns nicely with my beliefs about privacy and minimalism (ie. coming up with ideas for web applications that don't even need a backend).
- tzs 5y ago
  Article 3(2) is short. Here it is: > 2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: > (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or > (b) the monitoring of their behaviour as far as their behaviour takes place within the Union. Recital 23 includes an elaboration on (a): > In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union. Probably nothing to worry about for a hobby site.

ctime 5y ago

To be fair, both of the sites he mentioned are Indian (netmeds.com and makemytrip.com) I’m sure there are sites in the US, however, that block access from GDPR countries.

arihant 5y ago

Is there a study on comparing number of people actually selecting cookies on the pop ups vs. number of users who already had Adblock? Because unless you have that info, GDPR cannot be claimed to protect any privacy. How many people who never had Adblock are selecting which cookies they want on these pop ups? And it’s not only the US websites, the website OP mentioned is one of the three largest medicine websites in India. There is no reason for them to comply. And EU laws are incredibly confusing. Follow GDPR and respect privacy, while saving customer IP address for years when EU needs VAT.