7 ms·

I don't mean to be confrontational, but as an American with websites in the US- why would I care? The most basic tenet of sovereignty is that a country's laws s

I don't mean to be confrontational, but as an American with websites in the US- why would I care? The most basic tenet of sovereignty is that a country's laws stop at their border, unless otherwise agreed in a treaty. I may be violating GPDR, I may be violating some Internet content laws in Zimbabwe and Cambodia as well, but laws don't cross borders. Just as an example off the top of my head- in Thailand, it's illegal to insult their king. Would anyone here refrain from posting anti-Thai monarch content on their website, in fear of breaking the laws in Thailand? If not, why would I care about GPDR? Imagine what a non-sequitur it would be if if someone told an American employer based here in the states, that you're violating EU employment law. By definition it.... doesn't apply. I do understand that if I ran a business with European customers, I would need to be in compliance with EU law- I get that- but genuinely confused why I would care otherwise. Are your websites in compliance with Zimbabwean Internet law?

colechristensen 5y ago
You and your business are crossing borders when you serve traffic to foreign customers, and are thus party to their laws. No I'm not a lawyer, but if you really never intend to have any customers in Europe you'll probably be fine (ask a lawyer, not the Internet) but if you do or might then you're playing a game with whether or not you'll be caught or if the consequences will be more advantageous than mitigating them. America projects it's laws worldwide with the global financial system and anything with even a remote connection to the states is a poison pill that is used to prosecute behavior which is almost exclusively outside its borders. Other legal entities can do the same, but to a lesser extent.
- wepple 5y ago
  > You and your business are crossing borders when you serve traffic I’d argue that if the request originates outside my country, the customer has crossed the border with the intent to bring the content back to their country
  - rovr138 5y ago
    I'd definitely put the onus on them. It's pretty insane that even routing and logs will cause issues because of a law on their side.
    - netizen-936824 5y ago
      I agree there, but also there is the perspective that the consumer of the content did not ask your server to take their data for analytics purposes. So it goes both ways
      - rovr138 5y ago
        I understand that, but even without analytics, it wouldn't conform simply because it's hosted in the US and the IP can be stored there. The way routing works, you can't prevent the IP from going to the US if it's just hosted there.
        netizen-936824 5y ago
        AFAIK the IP from requests doesn't necessarily need to be logged or stored anywhere, does it? Perhaps this comes from my lack of understanding of GDPR but I thought the issue was from storage where it could be retrieved or shared
        janto 5y ago
        The problem is that the US CLOUD act compels US companies to provide data access to US agencies, regardless of where the data flows. It could even be servers on EU soil. EU courts hold that these kind of acts violate the data rights of individuals located in the EU.
  - bryanrasmussen 5y ago
    well, it seems that the EU has already decided that is not going to be the interpretation they will accept so argue away. There are also thousands of different analogies like yours that one might choose that would put the benefit on the EU side, for example, someone might argue your website is like a product and as such is open to all sorts of regulations and taxes when it gets 'imported'.
actually_a_dog 5y ago
Even if you don't think GDPR compliance is important, you probably need to consider the California Consumer Privacy Act and California Privacy Rights Act, if you are running a business that's big enough to be subject to them. These laws are broadly similar to GDPR.
- kbelder 5y ago
  Yeah, the GDPR is basically irrelevant to Americans unless you're a multinational corporation. But unless you're a VERY local business, you will want to take the CCPA into account, because California will be very happy to fine a business located in other states. CCPA is a little more reasonable than the GDPR, but if you're abiding by the CCPA you're probably good enough.
tobylane 5y ago
The law applies to websites, not businesses. If your website has European visitors, then it is making the relevant interaction even without business happening. I’ve come across websites that simply deny me access, guaranteeing they don’t have any European visitors. US law spreads in a few ways, eg licence to use the dollar, though that may be broader than the exact wording.
- MR4D 5y ago
  I would love to see this fought in court for my local neighborhood restaurant. No way would a US court hold that GDPR has any standing.
  - tobylane 5y ago
    I'm sure they wouldn't, as it's not a US law. But a local company may be small enough not to have to bother, just as they don't have to provide certain US law based employer benefits. > The second exception is for organizations with fewer than 250 employees. Small- and medium-sized enterprises (SMEs) are not totally exempt from the GDPR, but the regulation does free them from record-keeping obligations in most cases (see Article 30.5).
    - MR4D 5y ago
      I’d add to that Lawyers, Engineers, Financial Advisors, and many other roles that are licensed by territory. Regardless of what the GDPR says.
  - bryanrasmussen 5y ago
    I don't actually see any way that your local neighborhood restaurant, assuming your local neighborhood is not in the EU, will in any way be covered by the GDPR. It will for the first be too small to require much record keeping. Second, it is unlikely to be keeping any personally identifying information from someone using the site while in the EU because nobody is ordering food from a pizza place in NYC while sitting in Napoli. IP address is sometimes PII but more often not. Thirdly, as your local restaurant does not have any business operations in the EU any potential fines levied against them would probably be unenforceable. Those are just the top three things that spring to my mind though, pretty sure that there are other reasons the worry is nonsensical.
TacticalCoder 5y ago
> I don't mean to be confrontational, but as an American with websites in the US- why would I care? What about all the users on HN who have websites and who happen to be from the EU though? It's not because you don't care that no-one here cares.
- dylan604 5y ago
  Sure, but while you're post comes across as the American being dismissive of others, you're post also comes across as dismissive of a valid question from the American. Let me rephrase: If I as an American build a retail site for a side hustle that I have no intention of doing international business, do I still need to concern myself with international rules? It's "easy enough" to not allow sales to international locations, but not allowing the website to be viewed internationally is just too much damn work and goes above and beyond sane expectations.
tannhaeuser 5y ago
IANAL so I honestly can't answer that, and I can totally understand some US sites blocking EU IP ranges because of their business model as an ad outlet for Google or whatever third-party ads. But even if you don't agree with EU privacy regulations, I hope you can understand that the race to the bottom we've seen in the last decade or so when it comes to online content must somehow be stopped, especially if it is only benefitting very few quasi-monopolies. My hope would be that we could see a return to direct sponsoring or other first-party ad model, but perhaps I'm being naive here, and I'd appreciate insights from others. Personally, I don't have a problem with ads per se at all, provided they're respecting my privacy and don't come in the form of a JavaScript bomb.
deleted 5y ago
[deleted]
oi23joi 5y ago
You are absolutely right. Unfortunately, the European lawmakers doesn't understand how international law works, so they created a "worldwide" law without any possibility to enforce that law outside of the EU. For that reason some people call GDPR a paper tiger.
- dmitriid 5y ago
  They fully understand what international law is. You could say that US lawmakers don't understand international laws because US data laws are extraterritorial.
jdlshore 5y ago
The GDPR explicitly only affects businesses selling to Europeans¹, so you're correct: you don't have to care about it. ¹GDPR Article 3, section 2a. A broad reading would assume that any use of a site by Europeans is also covered (section 2b), but IIRC the various data protection authorities issued guidance that you're fine so long as your material isn't aimed at Europeans: e.g., no European pricing, etc.. https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/
davidjytang 5y ago
Explained here [Who does the data protection law apply to?](https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/application-regulation/who-does-data-protection-law-apply_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...)

colechristensen 5y ago

You and your business are crossing borders when you serve traffic to foreign customers, and are thus party to their laws. No I'm not a lawyer, but if you really never intend to have any customers in Europe you'll probably be fine (ask a lawyer, not the Internet) but if you do or might then you're playing a game with whether or not you'll be caught or if the consequences will be more advantageous than mitigating them. America projects it's laws worldwide with the global financial system and anything with even a remote connection to the states is a poison pill that is used to prosecute behavior which is almost exclusively outside its borders. Other legal entities can do the same, but to a lesser extent.

wepple 5y ago
> You and your business are crossing borders when you serve traffic I’d argue that if the request originates outside my country, the customer has crossed the border with the intent to bring the content back to their country
- rovr138 5y ago
  I'd definitely put the onus on them. It's pretty insane that even routing and logs will cause issues because of a law on their side.
  - netizen-936824 5y ago
    I agree there, but also there is the perspective that the consumer of the content did not ask your server to take their data for analytics purposes. So it goes both ways
    - rovr138 5y ago
      I understand that, but even without analytics, it wouldn't conform simply because it's hosted in the US and the IP can be stored there. The way routing works, you can't prevent the IP from going to the US if it's just hosted there.
      - netizen-936824 5y ago
        AFAIK the IP from requests doesn't necessarily need to be logged or stored anywhere, does it? Perhaps this comes from my lack of understanding of GDPR but I thought the issue was from storage where it could be retrieved or shared
        janto 5y ago
        The problem is that the US CLOUD act compels US companies to provide data access to US agencies, regardless of where the data flows. It could even be servers on EU soil. EU courts hold that these kind of acts violate the data rights of individuals located in the EU.
- bryanrasmussen 5y ago
  well, it seems that the EU has already decided that is not going to be the interpretation they will accept so argue away. There are also thousands of different analogies like yours that one might choose that would put the benefit on the EU side, for example, someone might argue your website is like a product and as such is open to all sorts of regulations and taxes when it gets 'imported'.

actually_a_dog 5y ago

Even if you don't think GDPR compliance is important, you probably need to consider the California Consumer Privacy Act and California Privacy Rights Act, if you are running a business that's big enough to be subject to them. These laws are broadly similar to GDPR.

kbelder 5y ago
Yeah, the GDPR is basically irrelevant to Americans unless you're a multinational corporation. But unless you're a VERY local business, you will want to take the CCPA into account, because California will be very happy to fine a business located in other states. CCPA is a little more reasonable than the GDPR, but if you're abiding by the CCPA you're probably good enough.

tobylane 5y ago

The law applies to websites, not businesses. If your website has European visitors, then it is making the relevant interaction even without business happening. I’ve come across websites that simply deny me access, guaranteeing they don’t have any European visitors. US law spreads in a few ways, eg licence to use the dollar, though that may be broader than the exact wording.

MR4D 5y ago
I would love to see this fought in court for my local neighborhood restaurant. No way would a US court hold that GDPR has any standing.
- tobylane 5y ago
  I'm sure they wouldn't, as it's not a US law. But a local company may be small enough not to have to bother, just as they don't have to provide certain US law based employer benefits. > The second exception is for organizations with fewer than 250 employees. Small- and medium-sized enterprises (SMEs) are not totally exempt from the GDPR, but the regulation does free them from record-keeping obligations in most cases (see Article 30.5).
  - MR4D 5y ago
    I’d add to that Lawyers, Engineers, Financial Advisors, and many other roles that are licensed by territory. Regardless of what the GDPR says.
- bryanrasmussen 5y ago
  I don't actually see any way that your local neighborhood restaurant, assuming your local neighborhood is not in the EU, will in any way be covered by the GDPR. It will for the first be too small to require much record keeping. Second, it is unlikely to be keeping any personally identifying information from someone using the site while in the EU because nobody is ordering food from a pizza place in NYC while sitting in Napoli. IP address is sometimes PII but more often not. Thirdly, as your local restaurant does not have any business operations in the EU any potential fines levied against them would probably be unenforceable. Those are just the top three things that spring to my mind though, pretty sure that there are other reasons the worry is nonsensical.

TacticalCoder 5y ago

> I don't mean to be confrontational, but as an American with websites in the US- why would I care? What about all the users on HN who have websites and who happen to be from the EU though? It's not because you don't care that no-one here cares.

dylan604 5y ago
Sure, but while you're post comes across as the American being dismissive of others, you're post also comes across as dismissive of a valid question from the American. Let me rephrase: If I as an American build a retail site for a side hustle that I have no intention of doing international business, do I still need to concern myself with international rules? It's "easy enough" to not allow sales to international locations, but not allowing the website to be viewed internationally is just too much damn work and goes above and beyond sane expectations.

tannhaeuser 5y ago

IANAL so I honestly can't answer that, and I can totally understand some US sites blocking EU IP ranges because of their business model as an ad outlet for Google or whatever third-party ads. But even if you don't agree with EU privacy regulations, I hope you can understand that the race to the bottom we've seen in the last decade or so when it comes to online content must somehow be stopped, especially if it is only benefitting very few quasi-monopolies. My hope would be that we could see a return to direct sponsoring or other first-party ad model, but perhaps I'm being naive here, and I'd appreciate insights from others. Personally, I don't have a problem with ads per se at all, provided they're respecting my privacy and don't come in the form of a JavaScript bomb.

deleted 5y ago

[deleted]

oi23joi 5y ago

You are absolutely right. Unfortunately, the European lawmakers doesn't understand how international law works, so they created a "worldwide" law without any possibility to enforce that law outside of the EU. For that reason some people call GDPR a paper tiger.

dmitriid 5y ago
They fully understand what international law is. You could say that US lawmakers don't understand international laws because US data laws are extraterritorial.

jdlshore 5y ago

The GDPR explicitly only affects businesses selling to Europeans¹, so you're correct: you don't have to care about it. ¹GDPR Article 3, section 2a. A broad reading would assume that any use of a site by Europeans is also covered (section 2b), but IIRC the various data protection authorities issued guidance that you're fine so long as your material isn't aimed at Europeans: e.g., no European pricing, etc.. https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/

davidjytang 5y ago

Explained here [Who does the data protection law apply to?](https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/application-regulation/who-does-data-protection-law-apply_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...)