3 ms·

It's like when, as a European user, you go to a website that's called something like Idaho Gazette because you follow a HN link and after seven years they still

It's like when, as a European user, you go to a website that's called something like Idaho Gazette because you follow a HN link and after seven years they still block you but tell you how important you are to them. I think if that was the case they could've just chosen to not collect any personal data from the five Euro users that show up once a year which would have taken less effort than putting that banner up

nerdponx 2y ago
It would have taken more effort, because the data collection is not something they have the ability to selectively disable, it's so backed into their platform and business model.
tzs 2y ago
> I think if that was the case they could've just chosen to not collect any personal data from the five Euro users that show up once a year which would have taken less effort than putting that banner up. Putting the banner up is less effort than reconfiguring your web server to not include IP addresses in the logs, and reworking your tools that currently use IP address such as various abuse detectors to use something else. Note that it is not as simple as hashing the IP address because the IP4 address space is small enough that hashing is easily reversed by brute force. You can probably justify logging IP addresses, at least if you don't keep the logs too long, under GDPR without having to ask the visitor for permission. GDPR provides several justifications for storing personal data besides consent. But it is still personal data, so if GDPR applies then there are compliance costs. For sites that are not in the Union and have no intention of serving people in the Union a block makes sense as a way to avoid that hassle. That's because for entities that are not in the Union determining whether or not GDPR applies when they are visited by people in the Union depends greatly on intent. Article 3, "Territorial scope", says it applies if they are offering goods or services to data subjects in the Union or they are monitoring the behavior of data subjects that takes place within the Union. The corresponding recitals says that offering goods or services means that the site envisages such offerings. Blocking visitors from the EU would be pretty good evidence that the site does not so envisage.

nerdponx 2y ago

It would have taken more effort, because the data collection is not something they have the ability to selectively disable, it's so backed into their platform and business model.

tzs 2y ago

> I think if that was the case they could've just chosen to not collect any personal data from the five Euro users that show up once a year which would have taken less effort than putting that banner up. Putting the banner up is less effort than reconfiguring your web server to not include IP addresses in the logs, and reworking your tools that currently use IP address such as various abuse detectors to use something else. Note that it is not as simple as hashing the IP address because the IP4 address space is small enough that hashing is easily reversed by brute force. You can probably justify logging IP addresses, at least if you don't keep the logs too long, under GDPR without having to ask the visitor for permission. GDPR provides several justifications for storing personal data besides consent. But it is still personal data, so if GDPR applies then there are compliance costs. For sites that are not in the Union and have no intention of serving people in the Union a block makes sense as a way to avoid that hassle. That's because for entities that are not in the Union determining whether or not GDPR applies when they are visited by people in the Union depends greatly on intent. Article 3, "Territorial scope", says it applies if they are offering goods or services to data subjects in the Union or they are monitoring the behavior of data subjects that takes place within the Union. The corresponding recitals says that offering goods or services means that the site envisages such offerings. Blocking visitors from the EU would be pretty good evidence that the site does not so envisage.