4 ms·

Once again, that ignores the third option, simply not embedding javascript tracking bloat in your site, or at least serving that version to the EU (since they'v

Once again, that ignores the third option, simply not embedding javascript tracking bloat in your site, or at least serving that version to the EU (since they've clearly already spent the technical resources of identifying it and serving a different response). You don't need to be a legal expert to just not collect data you don't need.

Alupis 4y ago
It's not that simple for non-technical organizations, I'm afraid. Simply embedding Google Analytics (the de facto website traffic analyzer, for better or worse) is enough to violate GDPR, and embedding Google Analytics is very often a simple checkbox in the web host admin portal. The "technical resources" involved in identifying EU traffic is nearly always just a simple IP block list, where one can often just checkmark a list of countries in their web host's portal. I think you grossly overestimate the technical prowess required to operate a website these days, and I think many grossly overestimate the actual real-world impact of GDPR outside the EU borders.
- LordDragonfang 4y ago
  Google Analytics is exactly the kind of tracker bloat I'm pointing out that a website serving static articles doesn't need. It can strip that out and serve a static html page, with no bloat, through Cloudflare, and even get their tracking through Cloudflare as well. The reason why such "technical prowess" is needed is because businesses have made it more complicated than it needs to be. Keep in mind, the context of this conversation is the arrogance of literally claiming claiming you are being "censored" (because that's what the 451 response code indicates), just because you refuse to remove tracking analytics from your website.
  - Alupis 4y ago
    I think this is a forest and trees situation. Using things like Cloudflare, alternative niche "privacy conscience" trackers, adding GDPR popups, etc. are all way above an beyond your average website operator's abilities or understanding. The dude trying to sell custom T-Shirts has a website because it's a necessity to sell T-Shirts, not because he enjoys operating, optimizing and customizing websites. He just wants to sell more T-Shirts, and some European Union law isn't going to give him pause even for a second if he is physically not in a EU country. While good intentioned, the GDPR was specifically designed to be a "viral" law and force the entire internet to comply... unfortunately the EU's long arm of the law is fairly short. Further, the EU's ability to enforce the GDPR is limited to businesses physically under it's jurisdiction - ie. the US is not going to extradite some website operator for an alleged GDPR violation, no matter how severe the case may be, and the EU can only fine a business into compliance if the business cares about EU laws (which would imply a physical presence in the EU). Ignoring the GDPR is the right move for most websites. If people desire comprehensive, impactful privacy guarantees, then a similar law needs to be passed within the US.
kube-system 4y ago
If there's not a tech expert in the room when a content publisher meets with their legal counsel, that is not a possibility anyone even realizes exists. It is also more expensive to implement than if(blocklist.contains(ip)) res.sendStatus(451)

Alupis 4y ago

It's not that simple for non-technical organizations, I'm afraid. Simply embedding Google Analytics (the de facto website traffic analyzer, for better or worse) is enough to violate GDPR, and embedding Google Analytics is very often a simple checkbox in the web host admin portal. The "technical resources" involved in identifying EU traffic is nearly always just a simple IP block list, where one can often just checkmark a list of countries in their web host's portal. I think you grossly overestimate the technical prowess required to operate a website these days, and I think many grossly overestimate the actual real-world impact of GDPR outside the EU borders.

LordDragonfang 4y ago
Google Analytics is exactly the kind of tracker bloat I'm pointing out that a website serving static articles doesn't need. It can strip that out and serve a static html page, with no bloat, through Cloudflare, and even get their tracking through Cloudflare as well. The reason why such "technical prowess" is needed is because businesses have made it more complicated than it needs to be. Keep in mind, the context of this conversation is the arrogance of literally claiming claiming you are being "censored" (because that's what the 451 response code indicates), just because you refuse to remove tracking analytics from your website.
- Alupis 4y ago
  I think this is a forest and trees situation. Using things like Cloudflare, alternative niche "privacy conscience" trackers, adding GDPR popups, etc. are all way above an beyond your average website operator's abilities or understanding. The dude trying to sell custom T-Shirts has a website because it's a necessity to sell T-Shirts, not because he enjoys operating, optimizing and customizing websites. He just wants to sell more T-Shirts, and some European Union law isn't going to give him pause even for a second if he is physically not in a EU country. While good intentioned, the GDPR was specifically designed to be a "viral" law and force the entire internet to comply... unfortunately the EU's long arm of the law is fairly short. Further, the EU's ability to enforce the GDPR is limited to businesses physically under it's jurisdiction - ie. the US is not going to extradite some website operator for an alleged GDPR violation, no matter how severe the case may be, and the EU can only fine a business into compliance if the business cares about EU laws (which would imply a physical presence in the EU). Ignoring the GDPR is the right move for most websites. If people desire comprehensive, impactful privacy guarantees, then a similar law needs to be passed within the US.

kube-system 4y ago

If there's not a tech expert in the room when a content publisher meets with their legal counsel, that is not a possibility anyone even realizes exists. It is also more expensive to implement than if(blocklist.contains(ip)) res.sendStatus(451)