2 ms·

> It's still an issue that essentially all sites are required* to include a cookie banner of some kind. IIRC the EU law even claims jurisdiction over sites in o

> It's still an issue that essentially all sites are required* to include a cookie banner of some kind. IIRC the EU law even claims jurisdiction over sites in other countries that only serve local audiences, on the notion that an EU national might visit the website. > > * "Required" here defined as "materially everyone, including the web developers at the EU, interprets the law this way." This is all commonly believed but isn't accurate. The only reason the web developers at the EU (correctly) feel like they need to ask for some kind of consent is because they want to use that consent to process visitors personal data beyond the scope of the essential cookies which I was describing. For cookies within only the essential scope, they wouldn't need consent or a banner at all, unless some law other than the GDPR requires proactive in-your-face disclosure of the fact that cookies are being set at all. The relevant consent doesn't have to be gained through a banner, but at least the EU websites' implementation doesn't involve dark patterns of making it easier to grant consent than refuse it. As for claiming jurisdiction over sites in other countries, a slightly simplified version of the rule in GDPR Article 3 is that they claim jurisdiction over such sites when they are targeting people in the EU, or when they are processing the data in the EU, or when they are an EU company processing the data outside of the EU. They do not claim jurisdiction over foreign sites that only serve foreign audiences, and they even give examples like that in their official guidance. To give one clear example right here: The GDPR does not generally apply to the case where someone in the EU visits a US-based website of a ski resort in the US, not even if they purchase a ticket via the website from the EU. By contrast, if the ski resort sets up a .eu website, translates their site into major EU languages that aren't very common in the US, allows purchasing in euros and via EU-centric payment methods like SEPA bank transfer and other methods specific to various EU countries, and so on, they're clearly targeting people in the EU so then the GDPR would apply. And so much unofficial guidance has inaccurately stated that nationality or citizenship is what determines GDPR rights. The most official sources, and the better unofficial sources, are clear that the location of the data subject matters but not their nationality or citizenship. An EU citizen doesn't get any more GDPR rights while in the US than someone who isn't an EU citizen.

runako 2y ago
Edit: making clearer, including text from the law. You inadvertently highlight one of the main issues with the GDPR: unclear guidance. From the "Does the GDPR apply to companies outside of the EU?" page at gdpr.eu: "If your organization uses web tools that allow you to track cookies or the IP addresses of people who visit your website from EU countries, then you fall under the scope of the GDPR. Practically speaking, it’s unclear how strictly this provision will be interpreted or how brazenly it will be enforced. Suppose you run a golf course in Manitoba focused exclusively on your local area, but sometimes people in France stumble across your site. Would you find yourself in the crosshairs of European regulators? It’s not likely. But technically you could be held accountable for tracking these data." Even their explanation is not clear. Notably, it's different from your understanding of whether it would apply. Which: I don't blame you, the law is not explained well anywhere I have seen. And their conclusion of "Not likely. But technically..." is not sufficient as official guidance. What if we go to the law itself? " 2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union. " Section b doesn't have the carveouts you asserted. Is that exemption in one of the other 98 articles, or an amendment, or elsewhere? Or does it not formally exist? If the hypothetical US ski resort uses e.g. Stripe that allows people to pay in whatever payment mechanisms are common in their countries, does that alone mean I am "targeting" EU residents? What if my billing page allows a customer to select Belgium in the billing address? What if I don't block shipping addresses in the EU? The intent here is not to litigate this to death, but rather to point out that the reason so much of the understanding of the law is contradictory is that the thing itself is complex. People don't want to get sanctioned, and putting cookie banners on sites is a way to prevent sanctions.
- ttepasse 2y ago
  gdpr.eu is a page operated by the Swiss Proton AG, not a page by the European Union.

runako 2y ago

Edit: making clearer, including text from the law. You inadvertently highlight one of the main issues with the GDPR: unclear guidance. From the "Does the GDPR apply to companies outside of the EU?" page at gdpr.eu: "If your organization uses web tools that allow you to track cookies or the IP addresses of people who visit your website from EU countries, then you fall under the scope of the GDPR. Practically speaking, it’s unclear how strictly this provision will be interpreted or how brazenly it will be enforced. Suppose you run a golf course in Manitoba focused exclusively on your local area, but sometimes people in France stumble across your site. Would you find yourself in the crosshairs of European regulators? It’s not likely. But technically you could be held accountable for tracking these data." Even their explanation is not clear. Notably, it's different from your understanding of whether it would apply. Which: I don't blame you, the law is not explained well anywhere I have seen. And their conclusion of "Not likely. But technically..." is not sufficient as official guidance. What if we go to the law itself? " 2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union. " Section b doesn't have the carveouts you asserted. Is that exemption in one of the other 98 articles, or an amendment, or elsewhere? Or does it not formally exist? If the hypothetical US ski resort uses e.g. Stripe that allows people to pay in whatever payment mechanisms are common in their countries, does that alone mean I am "targeting" EU residents? What if my billing page allows a customer to select Belgium in the billing address? What if I don't block shipping addresses in the EU? The intent here is not to litigate this to death, but rather to point out that the reason so much of the understanding of the law is contradictory is that the thing itself is complex. People don't want to get sanctioned, and putting cookie banners on sites is a way to prevent sanctions.

ttepasse 2y ago
gdpr.eu is a page operated by the Swiss Proton AG, not a page by the European Union.