6 ms·

The businesses have had more than enough time to comply with the law. Now is the time to start enforcing the law enough to make them actually care.

macinjosh 4y ago
Clearly, even the EU doesn’t care enough to enforce the law or they would have already. They’ve literally had years. What does it say about the credibility of the EU that it passes laws it doesn’t even enforce?
- deleted 4y ago
  [deleted]
- josefx 4y ago
  > They’ve literally had years. Almost exactly 2. The last agreement between the US and EU was nuked by Schrems II mid 2020. > What does it say about the credibility of the EU that it passes laws it doesn’t even enforce? Companies have already been successfully sued over it.
closewith 4y ago
Most businesses affected by this would have gone bankrupt if they had pre-emptively complied. Compliance means being unable to effectively use any of the major online advertising services. So while you could theoretically migrate from US cloud services (although where to is the question. Hertzner for cloud compute? Open Office for Office 365?), there’s no search engine or social network controlled in a country with a data adequacy decision. That means effectively no online advertising. If a company followed that route while all their competitors did not, their demand generation would have plummeted and they'd be out-of-business.
- tpxl 4y ago
  > That means effectively no online advertising. Wat. You can't sell out your users to google ads, that doesn't mean you can't advertise on google.
  - closewith 4y ago
    In practice, it does. It's impossible to use any of the major ad networks effectively without conversion tracking (which is what I'm assuming you're calling selling out? I disagree with that sentiment, given it amounts to sending a single pseudoanonymous ID with user consent). Edit: To be clear, most European enterprise companies would happily dump Google Analytics if not for Google Ads and the Search Console integration. Almost all will be already be using another tool for user analytics, but most online B2C companies are reliant on Google for demand generation, and Google Ads is only effective with conversion tracking.
    - tpxl 4y ago
      Does conversion tracking require you to track your users (a la google analytics), or is it actually just a pseudo'anonymous' parameter when visiting a website (like referrer could be, if advertisers hadn't killed it). And even then, advertising without tracking worked just fine without internet.
      - closewith 4y ago
        It requires getting consent and sending the value of a query parameter that was appended to the ad link the user clicked (GCLID for Google, FBCLID for Meta, etc) with some random (but now pseudonymous, because Google/Facebook/etc can link the session ID to the click ID to a user account) session ID and then sending that same session ID when the user converts/does the thing you want. If you get consent, you can also set a longer-lived cookie to determine if a user converts in a future visit. > And even then, advertising without tracking worked just fine without internet. There is even now a form of online advertising without any tracking (except in the most opt-in form of a discount code) which is sponsorships of videos, podcasts, articles, etc. However, for search and display ads, which drives a huge amount of traffic to EU businesses, there's no effective way to run ads without conversion tracking. Obviously you can just throw money at Google/Facebook, but without conversion tracking, the average return on advertising spend will be 1-10% of what it would be otherwise and you will pay for a lot of junk traffic. It's not unusual for B2C companies in the EU to make 80%+ of their online revenue from forms of ads that require conversion tracking, so it's impossible to expect businesses to refrain from online advertising unless all their competitors are required to also. This all relies on getting consent as a lawful basis for processing, and is currently acceptable under the GDPR except that the major networks are all US companies who could be compelled to transfer the data to US authorities. Even now, it is much more likely that a US CLOUD carve-out or other work-around for an adequacy decision with the US will be made than the CNIL interpretation will be followed to its logical conclusion, which is that EU businesses process personal data with any US-controlled vendor, even if it occurs in the EU.
- GekkePrutser 4y ago
  No online advertising sounds amazing . Although that's really the status quo for me the last few years with the amazing adblockers we have now.
  - closewith 4y ago
    It's not really the status quo you've experienced, as it's likely you've used ad funded services in that time.
fjfbsufhdvfy 4y ago
It is not possible to comply with this law as a small or even fairly large business if it prevents you from using the only viable major cloud services which are required for the operation of your business. Do you want the EU to delete the rest of their already behind tech industry?
- hansel_der 4y ago
  good point! it's far from 'required for the operation' it's just convenient. i.e. dumping waste enywhere is convenient and cheap, but if your business cannot survive otherwise, it's hard to argue for it's right to exist.
- martin_a 4y ago
  Bullshit. Why would those cloud services be required to run a business? We're doing just fine without them, hosting fonts locally, using Matomo, saving data on servers from EU companies. Its's possible, although Google etc. will of course tell you otherwise.
  - fastest963 4y ago
    Do these EU hosting companies also have servers available in other continents like North America? Could you operate a sufficiently global website from these hosting companies? Do they have S3-style or Pub/Sub-style features or do you have to build those in-house or maintain something off-the-shelf? If you're a small website maybe you can get by but if you get large you'll probably find you don't have many other options.
    - nephanth 4y ago
      Yes they do - https://www.ovhcloud.com/en/datacenters-ovhcloud/ https://www.ovhcloud.com/en/datacenters-ovhcloud/ - https://upcloud.com/about https://upcloud.com/about and others. The european cloud providers clearly don’t have as many features or market share as the GAFAM (they also tend to be more specialized), but contrary to what a lot of people here seem to believe, they have enough for most uses

macinjosh 4y ago

Clearly, even the EU doesn’t care enough to enforce the law or they would have already. They’ve literally had years. What does it say about the credibility of the EU that it passes laws it doesn’t even enforce?

deleted 4y ago
[deleted]
josefx 4y ago
> They’ve literally had years. Almost exactly 2. The last agreement between the US and EU was nuked by Schrems II mid 2020. > What does it say about the credibility of the EU that it passes laws it doesn’t even enforce? Companies have already been successfully sued over it.

closewith 4y ago

Most businesses affected by this would have gone bankrupt if they had pre-emptively complied. Compliance means being unable to effectively use any of the major online advertising services. So while you could theoretically migrate from US cloud services (although where to is the question. Hertzner for cloud compute? Open Office for Office 365?), there’s no search engine or social network controlled in a country with a data adequacy decision. That means effectively no online advertising. If a company followed that route while all their competitors did not, their demand generation would have plummeted and they'd be out-of-business.

tpxl 4y ago
> That means effectively no online advertising. Wat. You can't sell out your users to google ads, that doesn't mean you can't advertise on google.
- closewith 4y ago
  In practice, it does. It's impossible to use any of the major ad networks effectively without conversion tracking (which is what I'm assuming you're calling selling out? I disagree with that sentiment, given it amounts to sending a single pseudoanonymous ID with user consent). Edit: To be clear, most European enterprise companies would happily dump Google Analytics if not for Google Ads and the Search Console integration. Almost all will be already be using another tool for user analytics, but most online B2C companies are reliant on Google for demand generation, and Google Ads is only effective with conversion tracking.
  - tpxl 4y ago
    Does conversion tracking require you to track your users (a la google analytics), or is it actually just a pseudo'anonymous' parameter when visiting a website (like referrer could be, if advertisers hadn't killed it). And even then, advertising without tracking worked just fine without internet.
    - closewith 4y ago
      It requires getting consent and sending the value of a query parameter that was appended to the ad link the user clicked (GCLID for Google, FBCLID for Meta, etc) with some random (but now pseudonymous, because Google/Facebook/etc can link the session ID to the click ID to a user account) session ID and then sending that same session ID when the user converts/does the thing you want. If you get consent, you can also set a longer-lived cookie to determine if a user converts in a future visit. > And even then, advertising without tracking worked just fine without internet. There is even now a form of online advertising without any tracking (except in the most opt-in form of a discount code) which is sponsorships of videos, podcasts, articles, etc. However, for search and display ads, which drives a huge amount of traffic to EU businesses, there's no effective way to run ads without conversion tracking. Obviously you can just throw money at Google/Facebook, but without conversion tracking, the average return on advertising spend will be 1-10% of what it would be otherwise and you will pay for a lot of junk traffic. It's not unusual for B2C companies in the EU to make 80%+ of their online revenue from forms of ads that require conversion tracking, so it's impossible to expect businesses to refrain from online advertising unless all their competitors are required to also. This all relies on getting consent as a lawful basis for processing, and is currently acceptable under the GDPR except that the major networks are all US companies who could be compelled to transfer the data to US authorities. Even now, it is much more likely that a US CLOUD carve-out or other work-around for an adequacy decision with the US will be made than the CNIL interpretation will be followed to its logical conclusion, which is that EU businesses process personal data with any US-controlled vendor, even if it occurs in the EU.
GekkePrutser 4y ago
No online advertising sounds amazing . Although that's really the status quo for me the last few years with the amazing adblockers we have now.
- closewith 4y ago
  It's not really the status quo you've experienced, as it's likely you've used ad funded services in that time.

fjfbsufhdvfy 4y ago

It is not possible to comply with this law as a small or even fairly large business if it prevents you from using the only viable major cloud services which are required for the operation of your business. Do you want the EU to delete the rest of their already behind tech industry?

hansel_der 4y ago
good point! it's far from 'required for the operation' it's just convenient. i.e. dumping waste enywhere is convenient and cheap, but if your business cannot survive otherwise, it's hard to argue for it's right to exist.
martin_a 4y ago
Bullshit. Why would those cloud services be required to run a business? We're doing just fine without them, hosting fonts locally, using Matomo, saving data on servers from EU companies. Its's possible, although Google etc. will of course tell you otherwise.
- fastest963 4y ago
  Do these EU hosting companies also have servers available in other continents like North America? Could you operate a sufficiently global website from these hosting companies? Do they have S3-style or Pub/Sub-style features or do you have to build those in-house or maintain something off-the-shelf? If you're a small website maybe you can get by but if you get large you'll probably find you don't have many other options.
  - nephanth 4y ago
    Yes they do - https://www.ovhcloud.com/en/datacenters-ovhcloud/ https://www.ovhcloud.com/en/datacenters-ovhcloud/ - https://upcloud.com/about https://upcloud.com/about and others. The european cloud providers clearly don’t have as many features or market share as the GAFAM (they also tend to be more specialized), but contrary to what a lot of people here seem to believe, they have enough for most uses