5 ms·

Why do so many US sites block my EU IP address, citing GDPR?

by Retr0id 5y ago

seszett 5y ago
Their owner generally also owns an advertising business or similar and wants to make a point.
gjs278 5y ago
irrational 5y ago
When GDPR came out, we had a serious discussion about whether Europe having access to our site was important enough to implement GDPR, or if we should just block Europe all together. In the end we decided to bite the bullet and implement it, but it could easily have gone either way.
micromacrofoot 5y ago
because they'd rather block the EU than figure out if the GDPR has any implications for them, it's pure laziness
- hardolaf 5y ago
  It's also a cost. To be compliant, there's a bunch of mandatory expenses you have. It's not as simple as "just figure out the GDPR". Heck, just doing that is paying some lawyer $400-500/hr. And because it's the USA, GDPR compliance lawyers aren't around every corner. So you're probably paying extra above that.
  - micromacrofoot 5y ago
    there are no mandatory expenses, and you can indeed figure it out yourself… especially if you’re not selling things to europeans or handling personal data
    - hardolaf 5y ago
      Wow. You really have no idea how it works. This is a case about an IP address. The most basic thing that gets logged by most websites. You should honestly go out and hire an attorney to teach you about GDPR. Let us know what the legal bill is. This is why most US companies chose to just block the EU entirely. No need to deal with it or bad advice like what you're sharing here.
      - micromacrofoot 5y ago
        You're just drumming up the same scary nonsense, there's some weird fetish people seem to have where they show up to comment threads like this and say "OoOoOh but you don't really know". It's possible. I deal with European customers, their lawyers have signed off on my implementation.
        hardolaf 5y ago
        Lawyers signed off on sites using Google Analytics. Oops. Turns out that was a mistake.
throwhauser 5y ago
Presumably because the fines for getting GDPR wrong are potentially very high, where "less severe infringements could result in a fine of up to €10 million" and more serious infringements "could result in a fine of up to €20 million,". [0] Personally I'm afraid to make anything I'm working on publicly available, in case the server logging at some level isn't compliant. It's hard to be sure something hasn't been overlooked, and the monetary risk is very high. [0] https://gdpr.eu/fines/ https://gdpr.eu/fines/
- wizzwizz4 5y ago
  > It's hard to be sure something hasn't been overlooked. It's not that hard, unless you're using squillions of third-party services. And that's the kind of thing that GDPR is meant to discourage.
  - throwhauser 5y ago
    It is that hard. The level of certainty you need when "less serious" fines have 8 digits is hard even if you're just running HTTP "Hello World" on port 80 on the internet. The risk of a mistake in your configuration logging PII that you misplace and forget about is too high.
    - wizzwizz4 5y ago
      Note that stuff like basic request logging is likely to¹ fall under “legitimate interest”: you can keep that data, so long as you only use it for diagnostics, debugging and basic analytics (e.g., no selling your server logs to Facebook). You aren't going to get in trouble for your basic Hello World. And even if it didn't, the only PII that that would gather is IP addresses (and user agents, but I don't know that those count). It's relatively easy to hit your service from a local IP address with a custom User Agent, then check for that IP address and user agent in all the files on the machine. (Log files are pretty much all plain-text, but you could look for the two obvious byte encodings of the IP address too, if you like. Maybe also check the contents of gz files, but that's starting to get silly.) ¹: Read: I'm basically certain, but I'm not a lawyer and my understanding of the “legitimate interest” basis is not as good as my understanding of the rest of GDPR.
IAmEveryone 5y ago
It's only/mostly small-town newspapers that do this. It's an ideological statement that's cheap for them to make because The Buttherd Dispatch doesn't have enough readers in the EU for it to matter financially.
MauranKilom 5y ago
Because they have the choice of letting you choose what happens with your personal data (if you live in the EU) or not doing business there at all. In other words, if there's even a chance that you say no to them (ab)using your data any which way they like, they consider you a net negative to their business.
dekhn 5y ago
Because GDPR is too difficult to comply with. It's overbroad (covers far too many situations).

Why do so many US sites block my EU IP address, citing GDPR?

seszett 5y ago

Their owner generally also owns an advertising business or similar and wants to make a point.

gjs278 5y ago

irrational 5y ago

When GDPR came out, we had a serious discussion about whether Europe having access to our site was important enough to implement GDPR, or if we should just block Europe all together. In the end we decided to bite the bullet and implement it, but it could easily have gone either way.

micromacrofoot 5y ago

because they'd rather block the EU than figure out if the GDPR has any implications for them, it's pure laziness

hardolaf 5y ago
It's also a cost. To be compliant, there's a bunch of mandatory expenses you have. It's not as simple as "just figure out the GDPR". Heck, just doing that is paying some lawyer $400-500/hr. And because it's the USA, GDPR compliance lawyers aren't around every corner. So you're probably paying extra above that.
- micromacrofoot 5y ago
  there are no mandatory expenses, and you can indeed figure it out yourself… especially if you’re not selling things to europeans or handling personal data
  - hardolaf 5y ago
    Wow. You really have no idea how it works. This is a case about an IP address. The most basic thing that gets logged by most websites. You should honestly go out and hire an attorney to teach you about GDPR. Let us know what the legal bill is. This is why most US companies chose to just block the EU entirely. No need to deal with it or bad advice like what you're sharing here.
    - micromacrofoot 5y ago
      You're just drumming up the same scary nonsense, there's some weird fetish people seem to have where they show up to comment threads like this and say "OoOoOh but you don't really know". It's possible. I deal with European customers, their lawyers have signed off on my implementation.
      - hardolaf 5y ago
        Lawyers signed off on sites using Google Analytics. Oops. Turns out that was a mistake.

throwhauser 5y ago

Presumably because the fines for getting GDPR wrong are potentially very high, where "less severe infringements could result in a fine of up to €10 million" and more serious infringements "could result in a fine of up to €20 million,". [0] Personally I'm afraid to make anything I'm working on publicly available, in case the server logging at some level isn't compliant. It's hard to be sure something hasn't been overlooked, and the monetary risk is very high. [0] https://gdpr.eu/fines/ https://gdpr.eu/fines/

wizzwizz4 5y ago
> It's hard to be sure something hasn't been overlooked. It's not that hard, unless you're using squillions of third-party services. And that's the kind of thing that GDPR is meant to discourage.
- throwhauser 5y ago
  It is that hard. The level of certainty you need when "less serious" fines have 8 digits is hard even if you're just running HTTP "Hello World" on port 80 on the internet. The risk of a mistake in your configuration logging PII that you misplace and forget about is too high.
  - wizzwizz4 5y ago
    Note that stuff like basic request logging is likely to¹ fall under “legitimate interest”: you can keep that data, so long as you only use it for diagnostics, debugging and basic analytics (e.g., no selling your server logs to Facebook). You aren't going to get in trouble for your basic Hello World. And even if it didn't, the only PII that that would gather is IP addresses (and user agents, but I don't know that those count). It's relatively easy to hit your service from a local IP address with a custom User Agent, then check for that IP address and user agent in all the files on the machine. (Log files are pretty much all plain-text, but you could look for the two obvious byte encodings of the IP address too, if you like. Maybe also check the contents of gz files, but that's starting to get silly.) ¹: Read: I'm basically certain, but I'm not a lawyer and my understanding of the “legitimate interest” basis is not as good as my understanding of the rest of GDPR.

IAmEveryone 5y ago

It's only/mostly small-town newspapers that do this. It's an ideological statement that's cheap for them to make because The Buttherd Dispatch doesn't have enough readers in the EU for it to matter financially.

MauranKilom 5y ago

Because they have the choice of letting you choose what happens with your personal data (if you live in the EU) or not doing business there at all. In other words, if there's even a chance that you say no to them (ab)using your data any which way they like, they consider you a net negative to their business.

dekhn 5y ago

Because GDPR is too difficult to comply with. It's overbroad (covers far too many situations).