5 ms·

Websites have been given a practical choice between annoying popups and blocking Europe. It makes my life better when they block Europe, and I wish more did.

by btilly 4y ago

Websites have been given a practical choice between annoying popups and blocking Europe. It makes my life better when they block Europe, and I wish more did. I also wish Europe got rid of the GDPR.

nullc 4y ago
Or they could just not track people... pretty sad that this is unthinkable.
krisoft 4y ago
There is also the the third option of course: not tracking users.
- Alupis 4y ago
  A lot of non-technical organizations deem it safer (and cheaper) to just block EU users than to study the law, become domain experts, and implement lawyer-approved mechanisms to become compliant. The reality is, however, unless you have a major presence in the EU, or are the size of Google or Facebook... you can freely ignore the GDPR without consequence. EU laws do not apply across the ocean.
  - LordDragonfang 4y ago
    Once again, that ignores the third option, simply not embedding javascript tracking bloat in your site, or at least serving that version to the EU (since they've clearly already spent the technical resources of identifying it and serving a different response). You don't need to be a legal expert to just not collect data you don't need.
    - Alupis 4y ago
      It's not that simple for non-technical organizations, I'm afraid. Simply embedding Google Analytics (the de facto website traffic analyzer, for better or worse) is enough to violate GDPR, and embedding Google Analytics is very often a simple checkbox in the web host admin portal. The "technical resources" involved in identifying EU traffic is nearly always just a simple IP block list, where one can often just checkmark a list of countries in their web host's portal. I think you grossly overestimate the technical prowess required to operate a website these days, and I think many grossly overestimate the actual real-world impact of GDPR outside the EU borders.
      - LordDragonfang 4y ago
        Google Analytics is exactly the kind of tracker bloat I'm pointing out that a website serving static articles doesn't need. It can strip that out and serve a static html page, with no bloat, through Cloudflare, and even get their tracking through Cloudflare as well. The reason why such "technical prowess" is needed is because businesses have made it more complicated than it needs to be. Keep in mind, the context of this conversation is the arrogance of literally claiming claiming you are being "censored" (because that's what the 451 response code indicates), just because you refuse to remove tracking analytics from your website.
        Alupis 4y ago
        I think this is a forest and trees situation. Using things like Cloudflare, alternative niche "privacy conscience" trackers, adding GDPR popups, etc. are all way above an beyond your average website operator's abilities or understanding. The dude trying to sell custom T-Shirts has a website because it's a necessity to sell T-Shirts, not because he enjoys operating, optimizing and customizing websites. He just wants to sell more T-Shirts, and some European Union law isn't going to give him pause even for a second if he is physically not in a EU country. While good intentioned, the GDPR was specifically designed to be a "viral" law and force the entire internet to comply... unfortunately the EU's long arm of the law is fairly short. Further, the EU's ability to enforce the GDPR is limited to businesses physically under it's jurisdiction - ie. the US is not going to extradite some website operator for an alleged GDPR violation, no matter how severe the case may be, and the EU can only fine a business into compliance if the business cares about EU laws (which would imply a physical presence in the EU). Ignoring the GDPR is the right move for most websites. If people desire comprehensive, impactful privacy guarantees, then a similar law needs to be passed within the US.
    - kube-system 4y ago
      If there's not a tech expert in the room when a content publisher meets with their legal counsel, that is not a possibility anyone even realizes exists. It is also more expensive to implement than if(blocklist.contains(ip)) res.sendStatus(451)
IntrepidWorm 4y ago
The effective result of GDPR has been less than ideal, but was a step in the right direction. Abolishing it entirely in favor of a vacuum would carry a more weighty cost.
- mrandish 4y ago
  The frustrating part is that the unintended consequences of GDPR were inevitable and clearly foreseeable, yet it was passed into law anyway and now it's incredibly difficult (if not practically impossible) to fix through iterative adjustment. It often seems like politicians and bureaucrats are incapable of seeing the myriad ways their well-intended rules will fail in the real-world. Maybe all legislation should first have to pass an "Unintended Consequences Analysis" review. Meanwhile, GDPR is yet another disruptive annoyance to users, a burden on overworked, under-funded website teams and isn't delivering the benefits promised.
  - powerhour 4y ago
    It doesn't have to be disruptive to users, companies go out of their way to make it disruptive. As others here have said, companies can just stop adding code to track users and stop storing so much information. It's actually way less work.
    - babypuncher 4y ago
      But why blame the companies who are directly responsible for this annoyance when we can blame the government who is indirectly responsible?
    - Innominate 4y ago
      The GDPR covers tracking of users, but is much more broad in scope. Simply not tracking users doesn't stop the GDPR from applying. The GDPR provides a framework by which bad actors can do their thing legally without too much trouble. To a good actor, who only stores the data they actually need and doesn't track users, the GDPR still applies and is just as big a pain in the ass.
babypuncher 4y ago
Wouldn't you rather websites just stop invading your privacy? The EU is not to blame for the shitty business practices of these websites.
- tzs 4y ago
  GDPR has compliance costs even if you are doing nothing that violates privacy. As long as you've got data that can be associated with a user you might have GDPR obligations, including handling inquiries from users about what data you have about them, requests from users to delete their data, and similar. Just being able to receive such requests has costs, because GDPR requires that you have a contact in the Union that users can contact for such things. So say you've got an online forum in California and some EU people join and participate. Whether or not that is enough to make you subject to GDPR depends on Article 3(2). There's lots of subjectiveness in Article 3(2) so it is not at all clear where the boundaries are. If it does, then whether or not you have to have an in-Union representative is covered under Article 27. You do not need one if your processing of covered data is all of the following: (1) occasional, (2) does not fall under some special categories of data, (3) is unlikely to result in a "risk to the rights and freedoms of natural persons". That's pretty fuzzy. What is occasional processing? If you aren't sure that GDPR does not apply, or aren't sure that if it does your processing is occasional enough to fly under Article 27's radar, you need an Article 27 representative. Eventually there will be rulings from EU data regulators that will make the boundaries of Article 3(2) clearer, so that you may be able to stay in "does not apply" without blocking. Or maybe rulings will clarify Article 27 so you will be able to confidently determine that your processing is occasional enough to not need a rep. There's actually a lot of unclarity in GDPR. Take the data subject's right to have you delete their data. How do you actually implement that? Writing some scripts to delete from your database is probably not too hard. But what about backups? Do you need to go through all your backup sets and delete their data from those? What about printed records (yes, GDPR covers printed data)? Offsite long term archives? For a site like a forum, what about data that was in messages they posted that were quoted in messages from other users? Until all these kind of things are cleared up by EU data regulator rulings it can make a lot of sense for a site that is aimed mainly at a non-EU audience to block EU users.

by btilly 4y ago

Websites have been given a practical choice between annoying popups and blocking Europe. It makes my life better when they block Europe, and I wish more did. I also wish Europe got rid of the GDPR.

nullc 4y ago

Or they could just not track people... pretty sad that this is unthinkable.

krisoft 4y ago

There is also the the third option of course: not tracking users.

Alupis 4y ago
A lot of non-technical organizations deem it safer (and cheaper) to just block EU users than to study the law, become domain experts, and implement lawyer-approved mechanisms to become compliant. The reality is, however, unless you have a major presence in the EU, or are the size of Google or Facebook... you can freely ignore the GDPR without consequence. EU laws do not apply across the ocean.
- LordDragonfang 4y ago
  Once again, that ignores the third option, simply not embedding javascript tracking bloat in your site, or at least serving that version to the EU (since they've clearly already spent the technical resources of identifying it and serving a different response). You don't need to be a legal expert to just not collect data you don't need.
  - Alupis 4y ago
    It's not that simple for non-technical organizations, I'm afraid. Simply embedding Google Analytics (the de facto website traffic analyzer, for better or worse) is enough to violate GDPR, and embedding Google Analytics is very often a simple checkbox in the web host admin portal. The "technical resources" involved in identifying EU traffic is nearly always just a simple IP block list, where one can often just checkmark a list of countries in their web host's portal. I think you grossly overestimate the technical prowess required to operate a website these days, and I think many grossly overestimate the actual real-world impact of GDPR outside the EU borders.
    - LordDragonfang 4y ago
      Google Analytics is exactly the kind of tracker bloat I'm pointing out that a website serving static articles doesn't need. It can strip that out and serve a static html page, with no bloat, through Cloudflare, and even get their tracking through Cloudflare as well. The reason why such "technical prowess" is needed is because businesses have made it more complicated than it needs to be. Keep in mind, the context of this conversation is the arrogance of literally claiming claiming you are being "censored" (because that's what the 451 response code indicates), just because you refuse to remove tracking analytics from your website.
      - Alupis 4y ago
        I think this is a forest and trees situation. Using things like Cloudflare, alternative niche "privacy conscience" trackers, adding GDPR popups, etc. are all way above an beyond your average website operator's abilities or understanding. The dude trying to sell custom T-Shirts has a website because it's a necessity to sell T-Shirts, not because he enjoys operating, optimizing and customizing websites. He just wants to sell more T-Shirts, and some European Union law isn't going to give him pause even for a second if he is physically not in a EU country. While good intentioned, the GDPR was specifically designed to be a "viral" law and force the entire internet to comply... unfortunately the EU's long arm of the law is fairly short. Further, the EU's ability to enforce the GDPR is limited to businesses physically under it's jurisdiction - ie. the US is not going to extradite some website operator for an alleged GDPR violation, no matter how severe the case may be, and the EU can only fine a business into compliance if the business cares about EU laws (which would imply a physical presence in the EU). Ignoring the GDPR is the right move for most websites. If people desire comprehensive, impactful privacy guarantees, then a similar law needs to be passed within the US.
  - kube-system 4y ago
    If there's not a tech expert in the room when a content publisher meets with their legal counsel, that is not a possibility anyone even realizes exists. It is also more expensive to implement than if(blocklist.contains(ip)) res.sendStatus(451)

IntrepidWorm 4y ago

The effective result of GDPR has been less than ideal, but was a step in the right direction. Abolishing it entirely in favor of a vacuum would carry a more weighty cost.

mrandish 4y ago
The frustrating part is that the unintended consequences of GDPR were inevitable and clearly foreseeable, yet it was passed into law anyway and now it's incredibly difficult (if not practically impossible) to fix through iterative adjustment. It often seems like politicians and bureaucrats are incapable of seeing the myriad ways their well-intended rules will fail in the real-world. Maybe all legislation should first have to pass an "Unintended Consequences Analysis" review. Meanwhile, GDPR is yet another disruptive annoyance to users, a burden on overworked, under-funded website teams and isn't delivering the benefits promised.
- powerhour 4y ago
  It doesn't have to be disruptive to users, companies go out of their way to make it disruptive. As others here have said, companies can just stop adding code to track users and stop storing so much information. It's actually way less work.
  - babypuncher 4y ago
    But why blame the companies who are directly responsible for this annoyance when we can blame the government who is indirectly responsible?
  - Innominate 4y ago
    The GDPR covers tracking of users, but is much more broad in scope. Simply not tracking users doesn't stop the GDPR from applying. The GDPR provides a framework by which bad actors can do their thing legally without too much trouble. To a good actor, who only stores the data they actually need and doesn't track users, the GDPR still applies and is just as big a pain in the ass.

babypuncher 4y ago

Wouldn't you rather websites just stop invading your privacy? The EU is not to blame for the shitty business practices of these websites.

tzs 4y ago
GDPR has compliance costs even if you are doing nothing that violates privacy. As long as you've got data that can be associated with a user you might have GDPR obligations, including handling inquiries from users about what data you have about them, requests from users to delete their data, and similar. Just being able to receive such requests has costs, because GDPR requires that you have a contact in the Union that users can contact for such things. So say you've got an online forum in California and some EU people join and participate. Whether or not that is enough to make you subject to GDPR depends on Article 3(2). There's lots of subjectiveness in Article 3(2) so it is not at all clear where the boundaries are. If it does, then whether or not you have to have an in-Union representative is covered under Article 27. You do not need one if your processing of covered data is all of the following: (1) occasional, (2) does not fall under some special categories of data, (3) is unlikely to result in a "risk to the rights and freedoms of natural persons". That's pretty fuzzy. What is occasional processing? If you aren't sure that GDPR does not apply, or aren't sure that if it does your processing is occasional enough to fly under Article 27's radar, you need an Article 27 representative. Eventually there will be rulings from EU data regulators that will make the boundaries of Article 3(2) clearer, so that you may be able to stay in "does not apply" without blocking. Or maybe rulings will clarify Article 27 so you will be able to confidently determine that your processing is occasional enough to not need a rep. There's actually a lot of unclarity in GDPR. Take the data subject's right to have you delete their data. How do you actually implement that? Writing some scripts to delete from your database is probably not too hard. But what about backups? Do you need to go through all your backup sets and delete their data from those? What about printed records (yes, GDPR covers printed data)? Offsite long term archives? For a site like a forum, what about data that was in messages they posted that were quoted in messages from other users? Until all these kind of things are cleared up by EU data regulator rulings it can make a lot of sense for a site that is aimed mainly at a non-EU audience to block EU users.