4 ms·

It says Austrian business in the article. You aren't in their jurisdiction.

by moonchrome 5y ago

eatonphil 5y ago
> or your website services Austrian citizens I'm sure I get Austrian traffic from time to time.
- deleted 5y ago
  [deleted]
- micromacrofoot 5y ago
  you're not servicing anyone, you're not a business
- masswerk 5y ago
  I just made sure you do get traffic from Austria – there, you have it. :-) On the more serious side, I guess, the outcome may be that GA will be not allowed to collect certain data in Austria. (Just a personal opinion, not a legal advice.) Mind that you can add `ga('set', 'anonymizeIp', true);` to any GA embedding script, which should be more in compliance. (My guess is that GA will have to default to this mode anyway.) Edit: GDPR is about storing and processing personalized data. Meaning, if no personalized data is involved, there shouldn't be any need for even declaring it, nor should it be subject to explicit opt-in. On the other hand, we can't be sure, if `ga('set', 'anonymizeIp', true);` really does what it says. (Again, not a legal advice.)
  - _heimdall 5y ago
    Their anonymize IP feature is basically useless unfortunately. It can only anonymize the IP address in a visitor's browser, Google will still get the real IP address from the HTTP request. This feature doesn't do anything for GDPR compliance and almost certainly wouldn't hold up in court, if it ever came to that for a particular site.
    - masswerk 5y ago
      Yes, it's basically just like the do-not-track feature: we can only declare our intend, but we cannot be sure, whether or not this will be honoured on the server side of things. It would be up to Google to provide some kind of proof of legal relevance.
Retr0id 5y ago
Why do so many US sites block my EU IP address, citing GDPR?
- seszett 5y ago
  Their owner generally also owns an advertising business or similar and wants to make a point.
- gjs278 5y ago
- irrational 5y ago
  When GDPR came out, we had a serious discussion about whether Europe having access to our site was important enough to implement GDPR, or if we should just block Europe all together. In the end we decided to bite the bullet and implement it, but it could easily have gone either way.
- micromacrofoot 5y ago
  because they'd rather block the EU than figure out if the GDPR has any implications for them, it's pure laziness
  - hardolaf 5y ago
    It's also a cost. To be compliant, there's a bunch of mandatory expenses you have. It's not as simple as "just figure out the GDPR". Heck, just doing that is paying some lawyer $400-500/hr. And because it's the USA, GDPR compliance lawyers aren't around every corner. So you're probably paying extra above that.
    - micromacrofoot 5y ago
      there are no mandatory expenses, and you can indeed figure it out yourself… especially if you’re not selling things to europeans or handling personal data
tankenmate 5y ago
If you serve pages to EU citizens then you run the risk of breaking the law in Austria. If the Austrian Data Protection Authority (DSB[0]) were to take you to court (in Austria) then you (or your company) may be prosecuted. So the question then is would the DSB attempt prosecution? If they did and you don't offer a defence then you would probably lose by default. The question then would be are you judgement proof?[1] "The extraterritorial reach of the GDPR is broadly defined. It applies to a controller or processor of data when they are monitoring the behavior of data subjects within the EU, when they are processing data related to the offering of goods or services to data subjects in the EU, or when they have an establishment in the EU and the processing of data is happening in the context of that EU establishment." [2] This is not legal advice, etc. [0] https://www.data-protection-authority.gv.at/ https://www.data-protection-authority.gv.at/ [1] https://en.wikipedia.org/wiki/Judgment_proof https://en.wikipedia.org/wiki/Judgment_proof [2] https://www.clarip.com/data-privacy/gdpr-united-states/ https://www.clarip.com/data-privacy/gdpr-united-states/
- tankenmate 5y ago
  For further guidance the best source is probably the European Data Protection Board's (EDPB) own guidance for the territorial scope of the GDPR.[0] [0] https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_3_2018_territorial_scope_after_public_consultation_en.pdf https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_gui...

It says Austrian business in the article. You aren't in their jurisdiction.

eatonphil 5y ago

> or your website services Austrian citizens I'm sure I get Austrian traffic from time to time.

deleted 5y ago
[deleted]
micromacrofoot 5y ago
you're not servicing anyone, you're not a business
masswerk 5y ago
I just made sure you do get traffic from Austria – there, you have it. :-) On the more serious side, I guess, the outcome may be that GA will be not allowed to collect certain data in Austria. (Just a personal opinion, not a legal advice.) Mind that you can add `ga('set', 'anonymizeIp', true);` to any GA embedding script, which should be more in compliance. (My guess is that GA will have to default to this mode anyway.) Edit: GDPR is about storing and processing personalized data. Meaning, if no personalized data is involved, there shouldn't be any need for even declaring it, nor should it be subject to explicit opt-in. On the other hand, we can't be sure, if `ga('set', 'anonymizeIp', true);` really does what it says. (Again, not a legal advice.)
- _heimdall 5y ago
  Their anonymize IP feature is basically useless unfortunately. It can only anonymize the IP address in a visitor's browser, Google will still get the real IP address from the HTTP request. This feature doesn't do anything for GDPR compliance and almost certainly wouldn't hold up in court, if it ever came to that for a particular site.
  - masswerk 5y ago
    Yes, it's basically just like the do-not-track feature: we can only declare our intend, but we cannot be sure, whether or not this will be honoured on the server side of things. It would be up to Google to provide some kind of proof of legal relevance.

Retr0id 5y ago

Why do so many US sites block my EU IP address, citing GDPR?

seszett 5y ago
Their owner generally also owns an advertising business or similar and wants to make a point.
gjs278 5y ago
irrational 5y ago
When GDPR came out, we had a serious discussion about whether Europe having access to our site was important enough to implement GDPR, or if we should just block Europe all together. In the end we decided to bite the bullet and implement it, but it could easily have gone either way.
micromacrofoot 5y ago
because they'd rather block the EU than figure out if the GDPR has any implications for them, it's pure laziness
- hardolaf 5y ago
  It's also a cost. To be compliant, there's a bunch of mandatory expenses you have. It's not as simple as "just figure out the GDPR". Heck, just doing that is paying some lawyer $400-500/hr. And because it's the USA, GDPR compliance lawyers aren't around every corner. So you're probably paying extra above that.
  - micromacrofoot 5y ago
    there are no mandatory expenses, and you can indeed figure it out yourself… especially if you’re not selling things to europeans or handling personal data

tankenmate 5y ago

If you serve pages to EU citizens then you run the risk of breaking the law in Austria. If the Austrian Data Protection Authority (DSB[0]) were to take you to court (in Austria) then you (or your company) may be prosecuted. So the question then is would the DSB attempt prosecution? If they did and you don't offer a defence then you would probably lose by default. The question then would be are you judgement proof?[1] "The extraterritorial reach of the GDPR is broadly defined. It applies to a controller or processor of data when they are monitoring the behavior of data subjects within the EU, when they are processing data related to the offering of goods or services to data subjects in the EU, or when they have an establishment in the EU and the processing of data is happening in the context of that EU establishment." [2] This is not legal advice, etc. [0] https://www.data-protection-authority.gv.at/ https://www.data-protection-authority.gv.at/ [1] https://en.wikipedia.org/wiki/Judgment_proof https://en.wikipedia.org/wiki/Judgment_proof [2] https://www.clarip.com/data-privacy/gdpr-united-states/ https://www.clarip.com/data-privacy/gdpr-united-states/

tankenmate 5y ago
For further guidance the best source is probably the European Data Protection Board's (EDPB) own guidance for the territorial scope of the GDPR.[0] [0] https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_3_2018_territorial_scope_after_public_consultation_en.pdf https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_gui...