5 ms·

As the operator of a US-based site (and a rookie), what is the easiest way for me to deal with this? I'm thinking: - block EU traffic on a CDN level, or perhap

As the operator of a US-based site (and a rookie), what is the easiest way for me to deal with this? I'm thinking: - block EU traffic on a CDN level, or perhaps setting up a geoblock in nginx - ban EU citizens in the T&C on my site I'm not targeting European customers, so no need to worry about their rules. I just don't want to break a law inadvertently and get in trouble later. EDIT: the EU has every right to legislate whatever privacy regulations they want. I just don't target EU citizens. But if an EU citizen comes to my site somehow, I'm currently breaking the law over there; I don't want this to ever happen.

Kliment 5y ago
The easiest way is to not use google fonts.
- FredPret 5y ago
  But I like google fonts. And I don't like being told by a foreign entity that I can only use certain fonts.
  - vntok 5y ago
    The foreign entity does not forbid you to use any font at all, in any sense of the term. You are told by an assembly of elected representatives that you must treat their 450 million citizens' data with care and respect. You are perfectly allowed to self-host the fonts, use regional providers... or event block the zone entirely.
    - jokethrowaway 5y ago
      Now, let's make a poll and see how many of those 450mln citizens care. Nobody ever considered cookies or online data when they engaged with the indirectly democratic process which appointed those representatives. Those representatives are random politicians that can be bought by the dozen by large corporations. This is obviously another regulatory step towards guaranteeing only large companies will have the legal expertise to be on the internet, stifling competition and killing small and independent providers.
      - kmeisthax 5y ago
        Okay. Oh look, it turns out[0][1] Europeans generally know about GDPR's effects[2] and care about their privacy online. What a shocker. In fact, I bet if you ran a similar poll of "would Americans want privacy laws equivalent to the EU's", with a simple explanation of what that would entail, you'd probably get a pretty positive response to that, too. The problem here isn't the EU. It's US Congress, and it's insistence on shitty laws like the CLOUD Act that make it legally impossible to comply with any reasonable foreign privacy law by mandating that tech companies break them in lieu of a proper legal treaty. Bonus points to various UK and Australian[3] laws that collectively ban strong encryption in those territories, though I know of no current GDPR court ruling about that yet. [0] https://fra.europa.eu/en/news/2020/how-concerned-are-europeans-about-their-personal-data-online https://fra.europa.eu/en/news/2020/how-concerned-are-europea... [1] https://www.welivesecurity.com/2019/06/14/gdpr-europeans-awareness-rights/ https://www.welivesecurity.com/2019/06/14/gdpr-europeans-awa... [2] Oddly enough this only extends to knowledge of GDPR's effects. Nobody seems to remember that the law that gave them these new privacy rights is called "GDPR".
    - native_samples 5y ago
      Actually they're told by the commission which is elected by nobody. The EU parliament doesn't make law (i.e. it's not really a parliament). It's the civil service that does that in the EU. Parliament just rubber stamps it.
  - ceejayoz 5y ago
    You can self-host Google Fonts.
jtbayly 5y ago
By far, the easiest thing to do is ignore GDPR.
- gred 5y ago
  At least until you reach a certain size.
  - FredPret 5y ago
    That's a good problem to have, and then I'll get a lawyer!
- fennecfoxen 5y ago
  Second easiest thing to do is ban Europeans :)
CogitoCogito 5y ago
Could you host the fonts yourself?
- FredPret 5y ago
  That's probably simplest, but I want to cut this problem off at the root. Today they outlaw Google Fonts, tomorrow it's the next thing. I can't keep changing my site based on foreign legal opinions.
  - waffleiron 5y ago
    >I can't keep changing my site based on foreign legal opinions. Then block access from all other countries than your own, you'll never have to worry about any of it again.
    - jokethrowaway 5y ago
      Is this the internet we want? That's appalling
      - marcosdumay 5y ago
        Well, if the OP insists on sharing their visitors data with 3rd parties, and doesn't want to adapt his site to fix the specific instances other countries outlaw... then yes, it's better for everybody if he keeps it caged into his own country.
  - tiborsaas 5y ago
    Fixing privacy issues on your site is the best way to cut the problem at the root.
lmkg 5y ago
You probably don't have to do anything. I am of the opinion that blocking EU traffic potentially increases your exposure to GDPR, but this is not settled law. GDPR's territorial scope applies to international Controllers who are "targeting" EU residents. According to Recital 23, merely having a website doesn't qualify. There needs to be additional evidence that you are attempting to attract an EU audience. E.g. when selling goods, offering Euro as a currency. Blocking EU traffic means that you are specifically envision EU residents visiting your site. And blocking traffic from them is a type of data processing. IANAL, don't take advice from randos on the Internet, but if you're just some website then blocking EU visitors might be more trouble than it's worth. In either case, no DPA is going to give a shit about you. https://gdpr-info.eu/recitals/no-23/ https://gdpr-info.eu/recitals/no-23/
- FredPret 5y ago
  That's brilliant, thank you!!
- tzs 5y ago
  Recital 23 elaborates on Article 3 2(a), which covers the offering of goods or services to people in the Union as a bases for applying GDPR. There's also 2(b), which covers the monitoring of behavior as far as their behavior takes place within the Union. Recital 24 at https://gdpr-info.eu/recitals/no-24/ https://gdpr-info.eu/recitals/no-24/ elaborates on that: > The processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union should also be subject to this Regulation when it is related to the monitoring of the behaviour of such data subjects in so far as their behaviour takes place within the Union. > In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes. (line break added between sentences to make it easier to read). Unlike 2(a), 2(b) doesn't require any attempt to attract an EU audience so is more easy to accidentally fall under.
Archelaos 5y ago
There is probably no further action necessary. As long as you are not targeting people in Germany in particular, a German court would not open a case against you. Indications that you are specifically targeting people in Germany are if you use the German language or have more than the occasional visitors or customers from Germany. Of course, there is always a grey area as to where the real limits lie. For detailed information see the "Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)" (pdf), available at https://edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_3_2018_territorial_scope_en.pdf https://edpb.europa.eu/sites/default/files/files/file1/edpb_... Some core citations from this document (p.12-14): --- begin quote --- Article 3(2) of the GDPR provides that “this Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.” The application of the “targeting criterion” towards data subjects who are in the Union, as per Article 3(2), can be triggered by two distinct and alternative types of activities carried out by a controller or processor not established in the Union. In addition to being applicable only to a controller or processor not established in the Union, the targeting criteria largely focus on what the “processing activities” are “related to”, which is to be considered on a case-by-case basis. In assessing the conditions for the application of the criteria, the EDPB therefore recommends a twofold approach, in order to determine first that the processing relates to personal data of data subjects who are in the Union, and second whether it relates to the offering of goods or services or to the monitoring of data subjects’ behaviour in the Union. [Then some examples are given. A U.S. company providing a personalized travel app for tourists visiting London, Paris and Rome falls within the scope of the GDPR. But ...] The EDPB also wishes to underline that the fact of processing personal data of an individual in the Union alone is not sufficient to trigger the application of the GDPR to processing activities of a controller or processor not established in the Union. The element of "targeting" individuals in the EU, either by offering goods or services to them or by monitoring their behaviour (as further clarified below), must always be present in addition. Example 9: A U.S. citizen is travelling through Europe during his holidays. While in Europe, he downloads and uses a news app that is offered by a U.S. company. The app is exclusively directed at the U.S. market. The collection of the U.S. tourist's personal data via the app by the U.S. company is not subject to the GDPR. --- end quote ---
rascul 5y ago
> As the operator of a US-based site (and a rookie), what is the easiest way for me to deal with this? If you have no EU presence then why do you need to care?
- FredPret 5y ago
  There may be personal legal repercussions - I want to travel there freely, but never do business there.
  - rascul 5y ago
    That is an excellent point.

Kliment 5y ago

The easiest way is to not use google fonts.

FredPret 5y ago
But I like google fonts. And I don't like being told by a foreign entity that I can only use certain fonts.
- vntok 5y ago
  The foreign entity does not forbid you to use any font at all, in any sense of the term. You are told by an assembly of elected representatives that you must treat their 450 million citizens' data with care and respect. You are perfectly allowed to self-host the fonts, use regional providers... or event block the zone entirely.
  - jokethrowaway 5y ago
    Now, let's make a poll and see how many of those 450mln citizens care. Nobody ever considered cookies or online data when they engaged with the indirectly democratic process which appointed those representatives. Those representatives are random politicians that can be bought by the dozen by large corporations. This is obviously another regulatory step towards guaranteeing only large companies will have the legal expertise to be on the internet, stifling competition and killing small and independent providers.
    - kmeisthax 5y ago
      Okay. Oh look, it turns out[0][1] Europeans generally know about GDPR's effects[2] and care about their privacy online. What a shocker. In fact, I bet if you ran a similar poll of "would Americans want privacy laws equivalent to the EU's", with a simple explanation of what that would entail, you'd probably get a pretty positive response to that, too. The problem here isn't the EU. It's US Congress, and it's insistence on shitty laws like the CLOUD Act that make it legally impossible to comply with any reasonable foreign privacy law by mandating that tech companies break them in lieu of a proper legal treaty. Bonus points to various UK and Australian[3] laws that collectively ban strong encryption in those territories, though I know of no current GDPR court ruling about that yet. [0] https://fra.europa.eu/en/news/2020/how-concerned-are-europeans-about-their-personal-data-online https://fra.europa.eu/en/news/2020/how-concerned-are-europea... [1] https://www.welivesecurity.com/2019/06/14/gdpr-europeans-awareness-rights/ https://www.welivesecurity.com/2019/06/14/gdpr-europeans-awa... [2] Oddly enough this only extends to knowledge of GDPR's effects. Nobody seems to remember that the law that gave them these new privacy rights is called "GDPR".
  - native_samples 5y ago
    Actually they're told by the commission which is elected by nobody. The EU parliament doesn't make law (i.e. it's not really a parliament). It's the civil service that does that in the EU. Parliament just rubber stamps it.
- ceejayoz 5y ago
  You can self-host Google Fonts.

jtbayly 5y ago

By far, the easiest thing to do is ignore GDPR.

gred 5y ago
At least until you reach a certain size.
- FredPret 5y ago
  That's a good problem to have, and then I'll get a lawyer!
fennecfoxen 5y ago
Second easiest thing to do is ban Europeans :)

CogitoCogito 5y ago

Could you host the fonts yourself?

FredPret 5y ago
That's probably simplest, but I want to cut this problem off at the root. Today they outlaw Google Fonts, tomorrow it's the next thing. I can't keep changing my site based on foreign legal opinions.
- waffleiron 5y ago
  >I can't keep changing my site based on foreign legal opinions. Then block access from all other countries than your own, you'll never have to worry about any of it again.
  - jokethrowaway 5y ago
    Is this the internet we want? That's appalling
    - marcosdumay 5y ago
      Well, if the OP insists on sharing their visitors data with 3rd parties, and doesn't want to adapt his site to fix the specific instances other countries outlaw... then yes, it's better for everybody if he keeps it caged into his own country.
- tiborsaas 5y ago
  Fixing privacy issues on your site is the best way to cut the problem at the root.

lmkg 5y ago

You probably don't have to do anything. I am of the opinion that blocking EU traffic potentially increases your exposure to GDPR, but this is not settled law. GDPR's territorial scope applies to international Controllers who are "targeting" EU residents. According to Recital 23, merely having a website doesn't qualify. There needs to be additional evidence that you are attempting to attract an EU audience. E.g. when selling goods, offering Euro as a currency. Blocking EU traffic means that you are specifically envision EU residents visiting your site. And blocking traffic from them is a type of data processing. IANAL, don't take advice from randos on the Internet, but if you're just some website then blocking EU visitors might be more trouble than it's worth. In either case, no DPA is going to give a shit about you. https://gdpr-info.eu/recitals/no-23/ https://gdpr-info.eu/recitals/no-23/

FredPret 5y ago
That's brilliant, thank you!!
tzs 5y ago
Recital 23 elaborates on Article 3 2(a), which covers the offering of goods or services to people in the Union as a bases for applying GDPR. There's also 2(b), which covers the monitoring of behavior as far as their behavior takes place within the Union. Recital 24 at https://gdpr-info.eu/recitals/no-24/ https://gdpr-info.eu/recitals/no-24/ elaborates on that: > The processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union should also be subject to this Regulation when it is related to the monitoring of the behaviour of such data subjects in so far as their behaviour takes place within the Union. > In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes. (line break added between sentences to make it easier to read). Unlike 2(a), 2(b) doesn't require any attempt to attract an EU audience so is more easy to accidentally fall under.

Archelaos 5y ago

There is probably no further action necessary. As long as you are not targeting people in Germany in particular, a German court would not open a case against you. Indications that you are specifically targeting people in Germany are if you use the German language or have more than the occasional visitors or customers from Germany. Of course, there is always a grey area as to where the real limits lie. For detailed information see the "Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)" (pdf), available at https://edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_3_2018_territorial_scope_en.pdf https://edpb.europa.eu/sites/default/files/files/file1/edpb_... Some core citations from this document (p.12-14): --- begin quote --- Article 3(2) of the GDPR provides that “this Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.” The application of the “targeting criterion” towards data subjects who are in the Union, as per Article 3(2), can be triggered by two distinct and alternative types of activities carried out by a controller or processor not established in the Union. In addition to being applicable only to a controller or processor not established in the Union, the targeting criteria largely focus on what the “processing activities” are “related to”, which is to be considered on a case-by-case basis. In assessing the conditions for the application of the criteria, the EDPB therefore recommends a twofold approach, in order to determine first that the processing relates to personal data of data subjects who are in the Union, and second whether it relates to the offering of goods or services or to the monitoring of data subjects’ behaviour in the Union. [Then some examples are given. A U.S. company providing a personalized travel app for tourists visiting London, Paris and Rome falls within the scope of the GDPR. But ...] The EDPB also wishes to underline that the fact of processing personal data of an individual in the Union alone is not sufficient to trigger the application of the GDPR to processing activities of a controller or processor not established in the Union. The element of "targeting" individuals in the EU, either by offering goods or services to them or by monitoring their behaviour (as further clarified below), must always be present in addition. Example 9: A U.S. citizen is travelling through Europe during his holidays. While in Europe, he downloads and uses a news app that is offered by a U.S. company. The app is exclusively directed at the U.S. market. The collection of the U.S. tourist's personal data via the app by the U.S. company is not subject to the GDPR. --- end quote ---

rascul 5y ago

> As the operator of a US-based site (and a rookie), what is the easiest way for me to deal with this? If you have no EU presence then why do you need to care?

FredPret 5y ago
There may be personal legal repercussions - I want to travel there freely, but never do business there.
- rascul 5y ago
  That is an excellent point.