4 ms·

Has anyone figured out if this will literally impact the entire internet, or will it only impact people in the US or just people hosting servers in California?

Has anyone figured out if this will literally impact the entire internet, or will it only impact people in the US or just people hosting servers in California? If hosting in California is it enough to not utilize a hosting providers presence in California, or must everyone migrate to providers that do not have a presence in California?

shadowgovt 4y ago
Does the GDPR only impact people hosting in Europe?
- tgv 4y ago
  For some websites, yes, but on one hand the EU is a lot bigger, while on the other hand California is home to Google and facebook.
judge2020 4y ago
> Existing law, the Parent’s Accountability and Child Protection Act, requires a person or business that conducts business in California and that seeks to sell specified products or services to take reasonable steps to ensure that the purchaser is of legal age at the time of purchase or delivery, including verifying the age of the purchaser. My understanding is that the bill applies to the same businesses that the mentioned law does. Considering California has 40M people, that's not a cohort businesses can shut off from the internet.
- phoe-krk 4y ago
  > Considering California has 40M people, that's not a cohort businesses can shut off from the internet. As someone who lives in a 447-million European Union and who keeps on getting HTTP 451 responses from various US-based services and websites after GDPR has gone into effect, I can't help but chuckle at your comment.
  - tschwimmer 4y ago
    The most common users of "We're sorry but we can't be bothered to figure out how to comply with GDPR" notices I've seen are for smaller US-based media organizations. The newspapers like the Ft. Worth Star Telegram or the St. Louis Post Dispatch (random examples, not sure if they actually block EU traffic) have (probably correctly IMO) concluded that the cost to comply with GDPR is likely to be more the than the revenue that could be gained by allowing the occasional EU reader and so have concluded that the most rational choice of action is to block access from the EU. This is a very different proposition than saying that Tik Tok, Youtube and Facebook would block CA-based users. In addition to the obvious fact that they all have hundreds or thousands of employees in CA, they would be forgoing one of their most important markets in terms of advertising. Furthermore, a lot of the top creators on these platforms live in greater LA. It's a non-starter. If you're doing anything social for anything that's not an domestic only market (e.g. VKontakte, WeChat) then you need California.
    - dotancohen 4y ago
      > have concluded that the cost to comply with GDPR is likely to be more > the than the revenue that could be gained by allowing the occasional EU reader Why would anybody read the news from a source whose prime motivation is anything other than dissemination of information? Not to excuse the profit motivation, but simply not setting any cookies is as simple a "fix" as is blocking access, unless one were to argue for the marginal cost of serving the occasional additional webpage.
      - tschwimmer 4y ago
        There may very well be 0 web developers on the staffs of these newspapers. They could have bought 3rd party software, or they could have paid a consulting company to build a custom news site. In either case, your simple fix is not so simple. Even knowing that not setting cookies for EU users could be a high bar, and actually implementing is far out of reach. Say they go to the original consultant, who tells them they can pay $xx,000 to have GDPR compliance, or $x,000 to block EU users. Hopefully this starts making more sense. GDPR looks easy to comply with if you imagine you work for the newspaper. Instead, imagine that you literally are the person who currently works for the newspaper and it will become a bit more clear why they've made the decisions they've made.
- GekkePrutser 4y ago
  40M is not a lot on a global scale actually. For many websites that target a global audience that would not be a big number to lose out. Many US websites now block Europeans because they don't want to bother with the GDPR and I would not be surprised if the opposite starts happening too.
  - adventured 4y ago
    California nearly has the GDP of Germany and among the highest GDP per capita figures for any major population (~$85,000 - just below Switzerland). That's the difference. "For many websites that target a global audience that would not be a big number to lose out." Now replace that with India, Germany, Japan, France, or Britain; because California is in the same economic tier as those countries.
    - Buttons840 4y ago
      The GP argues that people are willing to cut off all of Europe. You try to refute their claim by saying that California is smaller than Europe. I don't understand your logic and am not persuaded. Did I miss something?
      - _abox 4y ago
        Indeed, I'm in the EU myself and I've seen several instances of "this site is not available to you due to GDPR". I'm sure sites that are not specifically targeting the US will consider this too if it becomes too much of a burden.
  - r00fus 4y ago
    LOL. California is the 5th largest market in the world. Let sites decide they don't want to be browsed from CA - nothing of value would be lost.
- w4ffl35 4y ago
  A popup on the homepage that says "are you over the age of 21?" for every site should work then, right? Or at least if you detect that the traffic is coming from California.
- macrolime 4y ago
  A lot of the time the choice is A: follow Californian law to get ads and income, even though you're in some other part of the world, or B: Don't follow Californian law,get no ads, thus no income and no site. The reason for this is that the companies that can give you ads on your website are mostly in California and needs to follow Californian law. If you want their ads, you'll need to follow Californian law too.
pwg 4y ago
Based on many of the "unknown reach" statements the author identified, it is impossible to say. One potential outcome, at least for US businesses where their legal teams believe they have some nexus to California, will be either: 1) apply these rules to any incoming California IP address; or 2) apply these rules to everyone, no matter where they are located. Naturally, the easier route above is to just do #2, which means these changes could, much like the EU's GDPR resulted in paranoid legal teams adding "cookie banners" everywhere, impact all sites that have any US presence at all.
- nilespotter 4y ago
  > much like the EU's GDPR resulted in paranoid legal teams adding "cookie banners" everywhere Shoutout to this [1] firefox plugin that I rely on daily [1] https://github.com/jannisch/cookie-popup-blocker https://github.com/jannisch/cookie-popup-blocker
- r3trohack3r 4y ago
  (1) is tricky. Laws like this do not apply to IP addresses AFAICT, they apply to people. Someone CA law applies to can access your server using a non-CA IP address and someone not restricted by this law can access your server using a CA address. I'd be surprised if you'd be "off the hook" for a child covered under this law accessing your service via a VPN. And, as a user, I'd be upset if I couldn't access your site using mullvad. I wonder if banning CA users in your ToS is sufficient for passing the burden of this law down to CA residents?
  - dotancohen 4y ago
    We may need an `X-Applicable-Laws` HTTP header.
ransom1538 4y ago
Eh. If this passed, most internet based firms will just bail on California. That legalese will invite thousands of law suites.
stickfigure 4y ago
Authors will just move content out of jurisdiction and stop caring. It's really hard to imagine that (say) France will extradite someone to California because their website didn't check your ID. See also: GDPR compliance by US websites.
- hot_gril 4y ago
  Well GDPR did succeed in making most US websites badger me about cookies.
mistrial9 4y ago
AFAIK in all of California there are only two real upstream providers for "residential Internet" and every - single - subscriber must pass through their gates. Think of the airport or a modern busy toll bridge in California.. you will be tagged, watched and recorded.. some people really believe this is the way society ought to be run. To respond to the question: yes, it will.. it will polarize and strengthen the darknet, first. Your ordinary Calif. consumer will have to buy more things, second. Fines and lengthy, pointless court action, third.

shadowgovt 4y ago

Does the GDPR only impact people hosting in Europe?

tgv 4y ago
For some websites, yes, but on one hand the EU is a lot bigger, while on the other hand California is home to Google and facebook.

judge2020 4y ago

> Existing law, the Parent’s Accountability and Child Protection Act, requires a person or business that conducts business in California and that seeks to sell specified products or services to take reasonable steps to ensure that the purchaser is of legal age at the time of purchase or delivery, including verifying the age of the purchaser. My understanding is that the bill applies to the same businesses that the mentioned law does. Considering California has 40M people, that's not a cohort businesses can shut off from the internet.

phoe-krk 4y ago
> Considering California has 40M people, that's not a cohort businesses can shut off from the internet. As someone who lives in a 447-million European Union and who keeps on getting HTTP 451 responses from various US-based services and websites after GDPR has gone into effect, I can't help but chuckle at your comment.
- tschwimmer 4y ago
  The most common users of "We're sorry but we can't be bothered to figure out how to comply with GDPR" notices I've seen are for smaller US-based media organizations. The newspapers like the Ft. Worth Star Telegram or the St. Louis Post Dispatch (random examples, not sure if they actually block EU traffic) have (probably correctly IMO) concluded that the cost to comply with GDPR is likely to be more the than the revenue that could be gained by allowing the occasional EU reader and so have concluded that the most rational choice of action is to block access from the EU. This is a very different proposition than saying that Tik Tok, Youtube and Facebook would block CA-based users. In addition to the obvious fact that they all have hundreds or thousands of employees in CA, they would be forgoing one of their most important markets in terms of advertising. Furthermore, a lot of the top creators on these platforms live in greater LA. It's a non-starter. If you're doing anything social for anything that's not an domestic only market (e.g. VKontakte, WeChat) then you need California.
  - dotancohen 4y ago
    > have concluded that the cost to comply with GDPR is likely to be more > the than the revenue that could be gained by allowing the occasional EU reader Why would anybody read the news from a source whose prime motivation is anything other than dissemination of information? Not to excuse the profit motivation, but simply not setting any cookies is as simple a "fix" as is blocking access, unless one were to argue for the marginal cost of serving the occasional additional webpage.
    - tschwimmer 4y ago
      There may very well be 0 web developers on the staffs of these newspapers. They could have bought 3rd party software, or they could have paid a consulting company to build a custom news site. In either case, your simple fix is not so simple. Even knowing that not setting cookies for EU users could be a high bar, and actually implementing is far out of reach. Say they go to the original consultant, who tells them they can pay $xx,000 to have GDPR compliance, or $x,000 to block EU users. Hopefully this starts making more sense. GDPR looks easy to comply with if you imagine you work for the newspaper. Instead, imagine that you literally are the person who currently works for the newspaper and it will become a bit more clear why they've made the decisions they've made.
GekkePrutser 4y ago
40M is not a lot on a global scale actually. For many websites that target a global audience that would not be a big number to lose out. Many US websites now block Europeans because they don't want to bother with the GDPR and I would not be surprised if the opposite starts happening too.
- adventured 4y ago
  California nearly has the GDP of Germany and among the highest GDP per capita figures for any major population (~$85,000 - just below Switzerland). That's the difference. "For many websites that target a global audience that would not be a big number to lose out." Now replace that with India, Germany, Japan, France, or Britain; because California is in the same economic tier as those countries.
  - Buttons840 4y ago
    The GP argues that people are willing to cut off all of Europe. You try to refute their claim by saying that California is smaller than Europe. I don't understand your logic and am not persuaded. Did I miss something?
    - _abox 4y ago
      Indeed, I'm in the EU myself and I've seen several instances of "this site is not available to you due to GDPR". I'm sure sites that are not specifically targeting the US will consider this too if it becomes too much of a burden.
- r00fus 4y ago
  LOL. California is the 5th largest market in the world. Let sites decide they don't want to be browsed from CA - nothing of value would be lost.
w4ffl35 4y ago
A popup on the homepage that says "are you over the age of 21?" for every site should work then, right? Or at least if you detect that the traffic is coming from California.
macrolime 4y ago
A lot of the time the choice is A: follow Californian law to get ads and income, even though you're in some other part of the world, or B: Don't follow Californian law,get no ads, thus no income and no site. The reason for this is that the companies that can give you ads on your website are mostly in California and needs to follow Californian law. If you want their ads, you'll need to follow Californian law too.

pwg 4y ago

Based on many of the "unknown reach" statements the author identified, it is impossible to say. One potential outcome, at least for US businesses where their legal teams believe they have some nexus to California, will be either: 1) apply these rules to any incoming California IP address; or 2) apply these rules to everyone, no matter where they are located. Naturally, the easier route above is to just do #2, which means these changes could, much like the EU's GDPR resulted in paranoid legal teams adding "cookie banners" everywhere, impact all sites that have any US presence at all.

nilespotter 4y ago
> much like the EU's GDPR resulted in paranoid legal teams adding "cookie banners" everywhere Shoutout to this [1] firefox plugin that I rely on daily [1] https://github.com/jannisch/cookie-popup-blocker https://github.com/jannisch/cookie-popup-blocker
r3trohack3r 4y ago
(1) is tricky. Laws like this do not apply to IP addresses AFAICT, they apply to people. Someone CA law applies to can access your server using a non-CA IP address and someone not restricted by this law can access your server using a CA address. I'd be surprised if you'd be "off the hook" for a child covered under this law accessing your service via a VPN. And, as a user, I'd be upset if I couldn't access your site using mullvad. I wonder if banning CA users in your ToS is sufficient for passing the burden of this law down to CA residents?
- dotancohen 4y ago
  We may need an `X-Applicable-Laws` HTTP header.

ransom1538 4y ago

Eh. If this passed, most internet based firms will just bail on California. That legalese will invite thousands of law suites.

stickfigure 4y ago

Authors will just move content out of jurisdiction and stop caring. It's really hard to imagine that (say) France will extradite someone to California because their website didn't check your ID. See also: GDPR compliance by US websites.

hot_gril 4y ago
Well GDPR did succeed in making most US websites badger me about cookies.

mistrial9 4y ago

AFAIK in all of California there are only two real upstream providers for "residential Internet" and every - single - subscriber must pass through their gates. Think of the airport or a modern busy toll bridge in California.. you will be tagged, watched and recorded.. some people really believe this is the way society ought to be run. To respond to the question: yes, it will.. it will polarize and strengthen the darknet, first. Your ordinary Calif. consumer will have to buy more things, second. Fines and lengthy, pointless court action, third.