4 ms·

It’s a local media outfit. Their international traffic is probably just this single article.

guitarbill 4y ago
If that were true, they wouldn't even have to worry about the GDPR. But it's almost never a "local media outfit" in the traditional sense; they're owned by a huge media company worth billions. And they might have to care about GDPR.
- Scoundreller 4y ago
  Ne star is the largest tv station owner in USA. I’m guessing the business model is consolidating everything onto as few back end setups as possible: https://en.m.wikipedia.org/wiki/Nexstar_Media_Group https://en.m.wikipedia.org/wiki/Nexstar_Media_Group
Dylan16807 4y ago
In which case it would cost nothing to turn off tracking instead of turning off the entire article. But it would be embarrassing to admit they can make such a thing.
- grogenaut 4y ago
  actually it would cost engineering time/money. those engineers are likely contractors or some of the highest paid folks at the paper who are likely barely staffed and dealing with the page load of a big article.
  - Dylan16807 4y ago
    They already showed their willingness to spend money on a cutoff. They could have done a different cutoff instead.
    - kube-system 4y ago
      Why would they do that? The problem they were intending to solve is their legal liability. The problem that Europeans can’t read their news without ads is not a problem they want to solve. They don’t want people reading their news without ads.
      - Dylan16807 4y ago
        The premise of this line of comments is that the international traffic is so small it's not even worth making an adsense account. Given that premise, there's no reason to want Europeans blocked other than spite or embarrassment. Simply not caring enough to put in extra effort wouldn't look so bad, but that's why I'm pointing out there's no real difference in effort.
        kube-system 4y ago
        > Given that premise, there's no reason to want Europeans blocked other than spite or embarrassment. Yes, there is another reason: legal liability under GDPR. if(maxmind.lookup(request.ip).isInEU()) { return 451 } …is the cheapest and easiest way to meet their legal obligation. It is way easier than setting up some alternative revenue stream and ensuring that it is compliant.
        Dylan16807 4y ago
        if(maxmind.lookup(request.ip).isInEU()) { return $body_text } Wow look I coded a version that still has the article with no more effort. > It is way easier than setting up some alternative revenue stream and ensuring that it is compliant. The premise of this comment chain is already that we are NOT setting that up. My previous comment was NOT suggesting we set one up.
        kube-system 4y ago
        They are a business and their goal is to make money. Monetarily, both solutions are approximately equal: get fined zero dollars and make zero dollars. This is all they care about. You may have a preference for one solution over the other, but this doesn’t mean they do. I think that the solution that they chose demonstrates quite well that they just simply don’t care.
- tzs 4y ago
  It costs to comply with GDPR even if you are doing no tracking. 1. If GDPR applies to you and you are not in the Union you must have a designated representing in the Union to receive GPDR requests (both from individuals wishing to exercise their GDPR rights and from regulators). So right off the bat you have to engage some service in the Union to handle that for you. There are such services that aren't very expensive, but it is something you have to deal with. 2. IP addresses are personal data according to many GDPR experts. Normal logging that is done by most web servers leaves you with a GDPR burden to deal with. It seems likely that storing this would be allowed without the need to obtain explicit consent because there is a legitimate business interest to that logging, but you still have to deal with requests from people to delete their data. So more hassle. 3. You will have to keep up with developments as regulators rule on the meaning if the tons of subjecting things in GDPR. If you are not in the Union but people who are in the Union use your site GDPR applies if either you are: A. offering goods or services to them (free or paid), or B. monitoring their behavior as far as their behavior takes place in the Union. For A you have to envisage offering goods or services to them. The mere fact that they can reach your site and use it is not sufficient. If you aren't monitoring behavior in a way that makes B apply, then whether or not GDPR applies comes down to whether or not you envisaged offering goods and services to people in the Union. That's a fairly subjective thing and I don't think there have been enough cases involving that yet for it to be clear just what that means. Blocking EU visitors makes it clear you did not envisage serving them saving you all the aforementioned hassles and annoyances.
  - Dylan16807 4y ago
    If IP address logging is enough to count as monitoring, then sending a block page doesn't fix the problem. If you're confident enough that you have a non-tracking response to EU citizens, then you already did the hard part, and you might as well dump the article contents into that response.
    - Scoundreller 4y ago
      Seems like a business opportunity: a load balancing rule that sends EU requests to your log-free tracker-stripping static file-generating server appliance (possibly EU hosted) which has google Adsense on it and a GDPR responder that responds to every GDPR request specifying all that.

If that were true, they wouldn't even have to worry about the GDPR. But it's almost never a "local media outfit" in the traditional sense; they're owned by a huge media company worth billions. And they might have to care about GDPR.

Scoundreller 4y ago
Ne star is the largest tv station owner in USA. I’m guessing the business model is consolidating everything onto as few back end setups as possible: https://en.m.wikipedia.org/wiki/Nexstar_Media_Group https://en.m.wikipedia.org/wiki/Nexstar_Media_Group

Dylan16807 4y ago

In which case it would cost nothing to turn off tracking instead of turning off the entire article. But it would be embarrassing to admit they can make such a thing.

grogenaut 4y ago
actually it would cost engineering time/money. those engineers are likely contractors or some of the highest paid folks at the paper who are likely barely staffed and dealing with the page load of a big article.
- Dylan16807 4y ago
  They already showed their willingness to spend money on a cutoff. They could have done a different cutoff instead.
  - kube-system 4y ago
    Why would they do that? The problem they were intending to solve is their legal liability. The problem that Europeans can’t read their news without ads is not a problem they want to solve. They don’t want people reading their news without ads.
    - Dylan16807 4y ago
      The premise of this line of comments is that the international traffic is so small it's not even worth making an adsense account. Given that premise, there's no reason to want Europeans blocked other than spite or embarrassment. Simply not caring enough to put in extra effort wouldn't look so bad, but that's why I'm pointing out there's no real difference in effort.
      - kube-system 4y ago
        > Given that premise, there's no reason to want Europeans blocked other than spite or embarrassment. Yes, there is another reason: legal liability under GDPR. if(maxmind.lookup(request.ip).isInEU()) { return 451 } …is the cheapest and easiest way to meet their legal obligation. It is way easier than setting up some alternative revenue stream and ensuring that it is compliant.
        Dylan16807 4y ago
        if(maxmind.lookup(request.ip).isInEU()) { return $body_text } Wow look I coded a version that still has the article with no more effort. > It is way easier than setting up some alternative revenue stream and ensuring that it is compliant. The premise of this comment chain is already that we are NOT setting that up. My previous comment was NOT suggesting we set one up.
        kube-system 4y ago
        They are a business and their goal is to make money. Monetarily, both solutions are approximately equal: get fined zero dollars and make zero dollars. This is all they care about. You may have a preference for one solution over the other, but this doesn’t mean they do. I think that the solution that they chose demonstrates quite well that they just simply don’t care.
tzs 4y ago
It costs to comply with GDPR even if you are doing no tracking. 1. If GDPR applies to you and you are not in the Union you must have a designated representing in the Union to receive GPDR requests (both from individuals wishing to exercise their GDPR rights and from regulators). So right off the bat you have to engage some service in the Union to handle that for you. There are such services that aren't very expensive, but it is something you have to deal with. 2. IP addresses are personal data according to many GDPR experts. Normal logging that is done by most web servers leaves you with a GDPR burden to deal with. It seems likely that storing this would be allowed without the need to obtain explicit consent because there is a legitimate business interest to that logging, but you still have to deal with requests from people to delete their data. So more hassle. 3. You will have to keep up with developments as regulators rule on the meaning if the tons of subjecting things in GDPR. If you are not in the Union but people who are in the Union use your site GDPR applies if either you are: A. offering goods or services to them (free or paid), or B. monitoring their behavior as far as their behavior takes place in the Union. For A you have to envisage offering goods or services to them. The mere fact that they can reach your site and use it is not sufficient. If you aren't monitoring behavior in a way that makes B apply, then whether or not GDPR applies comes down to whether or not you envisaged offering goods and services to people in the Union. That's a fairly subjective thing and I don't think there have been enough cases involving that yet for it to be clear just what that means. Blocking EU visitors makes it clear you did not envisage serving them saving you all the aforementioned hassles and annoyances.
- Dylan16807 4y ago
  If IP address logging is enough to count as monitoring, then sending a block page doesn't fix the problem. If you're confident enough that you have a non-tracking response to EU citizens, then you already did the hard part, and you might as well dump the article contents into that response.
  - Scoundreller 4y ago
    Seems like a business opportunity: a load balancing rule that sends EU requests to your log-free tracker-stripping static file-generating server appliance (possibly EU hosted) which has google Adsense on it and a GDPR responder that responds to every GDPR request specifying all that.