4 ms·

They banned it for sites that are hosted in the EU I guess, but that isn't most sites so...not in practice.

deleted 4y ago
[deleted]
fariszr 4y ago
Actually no, the GDPR applies to all European citizens around the world. And if your website targets a global audience, then by extension you target EU users, which means you have to comply with the GDPR too.
- PrimeMcFly 4y ago
  Well, that's just nonsense though. They have no way to really enforce that. And I've actually put that to the test. For some medium size websites I manage that get about 30% of traffic from EU countries, instead of an annoying cookie banner, I have a banner saying the GDPR does not apply as the server is not hosted in the EU, they are free to adjust their browser settings as they like, and they're free to file a GDPR complaint and take action. And there's only an 'I accept' button, by design. So far, nothing has happened, and I doubt it ever will.
  - pier25 4y ago
    Under the GDPR IPs are considered personal data. If you have EU users visiting your site, then you are receiving their IPs, correct? "The whole point of the GDPR is to protect data belonging to EU citizens and residents. The law, therefore, applies to organizations that handle such data whether they are EU-based organizations or not, known as “extra-territorial effect.”" https://gdpr.eu/companies-outside-of-europe/ https://gdpr.eu/companies-outside-of-europe/
    - PrimeMcFly 4y ago
      Oh, I understand the EU says the law applies, I just disagree that it does. Does Chinese law apply in France to Chinese citizens that have emigrated there? China would say yes, they even set up secret police stations to enforce it. But does that make it so?
      - pier25 4y ago
        A company from China selling products in the France would have to comply with France laws, no?
        PrimeMcFly 4y ago
        How about you respond to the example I gave which is more analogous. The GDPR doesn't only apply to commerce sites.
        pier25 4y ago
        My point wasn't about selling products but about a foreign company having some activity in the EU. I agree with you the EU is probably not going to prosecute you, but that doesn't mean it's legal.
        PrimeMcFly 4y ago
        So I ask you again, are China's censorship laws enforceable in France just because they say they are? If you don't think that analogy is accurate, can you explain why?
        pier25 4y ago
        IANAL but it seems like a totally different scenario. Regarding the censorship, obviously the laws apply inside Chinese territory. France is not China so the laws do not apply. But regarding GDPR, the EU user is still inside EU territory when visiting your website and giving you his personal data. If this user was, I don't know, in Indonesia while visiting your website, then Indonesian laws would probably apply. Which is why the analogy of a foreign company doing some activity in the EU (like selling a product) seems more apt. Again, IANAL and this is just my superficial impression.
  - jeroenhd 4y ago
    You're right that foreign laws don't apply to you if you're not doing anything inside the laws' jurisdiction (physically or digitally, like using European TLDs or doing business with European companies). As long as you never go to Europe for any reason, there's no way for the EU to get you. At worst your website will get blocked inside the EU. And, of course, any companies using your services to service EU countries would be violating the GDPR themselves so may lose out on some potential customers. I don't see the point in claiming the law doesn't apply to you, though. If it doesn't, you don't need a cookie banner.
    - PrimeMcFly 4y ago
      That is my point though. It's up to the EU to block sites they don't feel are compliant with the laws they have passed, which they don't have control over. What is the point in claiming a law applies if they can't enforce it? Would it not make much more sense for the GDPR to have a provision blocking sites they can't control, or to allow for treaties between countries? It may allow both of those things already, in which case, it's even more perplexing to try and claim global jurisdiction as they do. And I don't need a cookie banner. The one I have is a subverion to make a point.
- from 4y ago
  The EU lacks the leverage America has that is required for extraterritoriality. Which non-EU country recognizes EU privacy regulator fines?
- tremon 4y ago
  > if your website targets a global audience, then by extension you target EU users This is nonsense. The GDPR only applies if you actively target users in the EU, such as by offering French/German/Swedish translations, or supporting the Euro currency in your shop. From the horse's mouth (https://gdpr-info.eu/recitals/no-23/ https://gdpr-info.eu/recitals/no-23/): the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention
- tzs 4y ago
  > Actually no, the GDPR applies to all European citizens around the world. Actually, GDPR applies to (1) people who are "in the Union", and (2) people whose data is being processed by processors who are "in the Union". Citizenship has nothing to do with it.

deleted 4y ago

[deleted]

Actually no, the GDPR applies to all European citizens around the world. And if your website targets a global audience, then by extension you target EU users, which means you have to comply with the GDPR too.

PrimeMcFly 4y ago
Well, that's just nonsense though. They have no way to really enforce that. And I've actually put that to the test. For some medium size websites I manage that get about 30% of traffic from EU countries, instead of an annoying cookie banner, I have a banner saying the GDPR does not apply as the server is not hosted in the EU, they are free to adjust their browser settings as they like, and they're free to file a GDPR complaint and take action. And there's only an 'I accept' button, by design. So far, nothing has happened, and I doubt it ever will.
- pier25 4y ago
  Under the GDPR IPs are considered personal data. If you have EU users visiting your site, then you are receiving their IPs, correct? "The whole point of the GDPR is to protect data belonging to EU citizens and residents. The law, therefore, applies to organizations that handle such data whether they are EU-based organizations or not, known as “extra-territorial effect.”" https://gdpr.eu/companies-outside-of-europe/ https://gdpr.eu/companies-outside-of-europe/
  - PrimeMcFly 4y ago
    Oh, I understand the EU says the law applies, I just disagree that it does. Does Chinese law apply in France to Chinese citizens that have emigrated there? China would say yes, they even set up secret police stations to enforce it. But does that make it so?
    - pier25 4y ago
      A company from China selling products in the France would have to comply with France laws, no?
      - PrimeMcFly 4y ago
        How about you respond to the example I gave which is more analogous. The GDPR doesn't only apply to commerce sites.
        pier25 4y ago
        My point wasn't about selling products but about a foreign company having some activity in the EU. I agree with you the EU is probably not going to prosecute you, but that doesn't mean it's legal.
        PrimeMcFly 4y ago
        So I ask you again, are China's censorship laws enforceable in France just because they say they are? If you don't think that analogy is accurate, can you explain why?
        pier25 4y ago
        IANAL but it seems like a totally different scenario. Regarding the censorship, obviously the laws apply inside Chinese territory. France is not China so the laws do not apply. But regarding GDPR, the EU user is still inside EU territory when visiting your website and giving you his personal data. If this user was, I don't know, in Indonesia while visiting your website, then Indonesian laws would probably apply. Which is why the analogy of a foreign company doing some activity in the EU (like selling a product) seems more apt. Again, IANAL and this is just my superficial impression.
- jeroenhd 4y ago
  You're right that foreign laws don't apply to you if you're not doing anything inside the laws' jurisdiction (physically or digitally, like using European TLDs or doing business with European companies). As long as you never go to Europe for any reason, there's no way for the EU to get you. At worst your website will get blocked inside the EU. And, of course, any companies using your services to service EU countries would be violating the GDPR themselves so may lose out on some potential customers. I don't see the point in claiming the law doesn't apply to you, though. If it doesn't, you don't need a cookie banner.
  - PrimeMcFly 4y ago
    That is my point though. It's up to the EU to block sites they don't feel are compliant with the laws they have passed, which they don't have control over. What is the point in claiming a law applies if they can't enforce it? Would it not make much more sense for the GDPR to have a provision blocking sites they can't control, or to allow for treaties between countries? It may allow both of those things already, in which case, it's even more perplexing to try and claim global jurisdiction as they do. And I don't need a cookie banner. The one I have is a subverion to make a point.
from 4y ago
The EU lacks the leverage America has that is required for extraterritoriality. Which non-EU country recognizes EU privacy regulator fines?
tremon 4y ago
> if your website targets a global audience, then by extension you target EU users This is nonsense. The GDPR only applies if you actively target users in the EU, such as by offering French/German/Swedish translations, or supporting the Euro currency in your shop. From the horse's mouth (https://gdpr-info.eu/recitals/no-23/ https://gdpr-info.eu/recitals/no-23/): the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention
tzs 4y ago
> Actually no, the GDPR applies to all European citizens around the world. Actually, GDPR applies to (1) people who are "in the Union", and (2) people whose data is being processed by processors who are "in the Union". Citizenship has nothing to do with it.