4 ms·

You can literally read the entire "complicated" regulation in one sitting in an afternoon. There's literally nothing complex or complicated about it. Congrats

by troupo 7mo ago

You can literally read the entire "complicated" regulation in one sitting in an afternoon. There's literally nothing complex or complicated about it. Congrats on gullibly believing the ad tech narrative.

ryandrake 7mo ago
The "GDPR is complicated" meme has been circulating among software developers since probably before it was even written. It's so wild that HN dunks on it so much: Here we have a societal problem in computing we've been complaining about for decades, someone offers an incremental but imperfect regulation to start taking steps to correct it, and everyone hates it!
- pocksuppet 7mo ago
  Same with the California age input box.
  - lukeschlather 7mo ago
    The problem with the age input box is that we don't have the GDPR. We're mandating that people give accurate age information to advertisers, and it's legal for advertisers to sell detailed dossiers on people including their age and target advertising using the age. This is why Meta wrote the age input box legislation, they want to make everyone legally required to provide Meta with their age.
    - pocksuppet 7mo ago
      No actually it's not mandated to be accurate
- IX-103 7mo ago
  The GDPR is vague and unworkable as written. It fundamentally restricts all data processing with a few, vague exceptions. What is data processing essential for the services being provided? Many publishers assumed that getting paid was an essential part of providing a service, and it was not until 3 months before the implementation deadline that the committee clarified that getting paid is not included when you are being paid by a third party. How are you to know whether or not the user is an EU citizen (and thus subject to the GDPR)? Is making that determination a service essential for providing your service? The answers apparently were "You don't" and "No", which would effectively make companies assume that the GDPR applies to everyone on the planet. The GDPR also is fundamentally opposed to how things currently work in the internet, making almost all advertising on the web illegal overnight. It was too big of a change to happen at once, so it effectively only loosely enforced in practice. I like the idea of the GDPR, but the implementation sucks.
  - GJim 7mo ago
    > The GDPR is vague and unworkable as written. It fundamentally restricts all data processing with a few, vague exceptions. What utter utter FUD You are free to collect as much personal data as you want, PROVIDING you have my explicit opt-in informed consent to do so. What about this is difficult to understand? > How are you to know whether or not the user is an EU citizen (and thus subject to the GDPR)? The GDPR provides _basic_ data safety and consumer protection. If you aren't protecting users private data regardless of where they live in line with GDPR principles (such as collecting it fairly, and not selling it to randoms) then you are playing fast and loose with your users private, sensitive data. In which case you need to _seriously_ consider if what you are doing is ethical. > The GDPR also is fundamentally opposed to how things currently work in the internet, making almost all advertising on the web illegal overnight. Utter Bullshit! You are free to advertise as much as you like! But if you want to track me with your advertising (hello scummy adtech industry) then you need my explicit informed consent to do so. And so you should! Again, what about this is difficult to understand?
    - ryandrake 7mo ago
      > If you aren't protecting users private data regardless of where they live in line with GDPR principles (such as collecting it fairly, and not selling it to randoms) then you are playing fast and loose with your users private, sensitive data. It's interesting and revealing when someone responds to a law that says "You're not allowed to abuse users in countries X, Y, and Z" with "How can I figure out who's in the other countries, so I can abuse them?" instead of "I'll just stop abusing everyone, and then I don't even need to worry about where anyone is." Whenever you find yourself asking "how do I toe as close to the 'illegal' line as I can without technically going over it?" I think it's time to ask yourself some pretty hard questions.
      - troupo 7mo ago
        Your entire reply is both a non sequitur, and doesn't even attempt to understand what people tell you
- kentm 7mo ago
  > It's so wild that HN dunks on it so much: Here we have a societal problem in computing we've been complaining about for decades, someone offers an incremental but imperfect regulation to start taking steps to correct it, and everyone hates it! YOUR collection of user's data is an overreach and breach of privacy. MY collection of data is absolutely necessary to grow my scrappy small business and provide value. I am a good person with good intentions, so its OK. You are a bad person doing bad things, so its not OK.
ch4s3 7mo ago
Being able to read something in one sitting doesn't make it simple or obvious. The law establishes a board that gets to set new requirements.
- stavros 7mo ago
  As someone who has to implement it, it's really not bad at all: Ask the user for consent to use their data, and don't be misleading about it. That's it. The rest of the "It'S So LaRgE AnD UndErSpEciFieD" is just FUD. The regulators don't just slap fines, they work with you to get you to comply, and they just want to see that you're putting in the effort instead of messing them about. I have literally never been surprised by the GDPR. Whenever I thought "surely this is allowed" it was, whenever I thought "this can't be allowed", it wasn't. For everything in the middle, nobody will punish you for an honest mistake.
  - redwall_hp 7mo ago
    Anti GDPR people: "it's so complicated not being able to walk into someone's house and take their things! Which things can I not take? How about this? And now I need a lawyer if I take someone's things? Ridiculous!" Just don't spy on people.
    - stavros 7mo ago
      Yeah that's pretty much what it feels like, or sometimes it's "what if someone's stuff is lying on the street? Can I take it then?" and the regulator is kind of like "look around and ask if it belongs to anyone, and if not, sure".
  - ch4s3 7mo ago
    > for everything in the middle, nobody will punish you for an honest mistake. How do you know that? Again the law establishes a rules making body that can at any time change or add rules, and as far as I can tell there's no public review process.
    - 7mo ago

by troupo 7mo ago

ryandrake 7mo ago

The "GDPR is complicated" meme has been circulating among software developers since probably before it was even written. It's so wild that HN dunks on it so much: Here we have a societal problem in computing we've been complaining about for decades, someone offers an incremental but imperfect regulation to start taking steps to correct it, and everyone hates it!

pocksuppet 7mo ago
Same with the California age input box.
- lukeschlather 7mo ago
  The problem with the age input box is that we don't have the GDPR. We're mandating that people give accurate age information to advertisers, and it's legal for advertisers to sell detailed dossiers on people including their age and target advertising using the age. This is why Meta wrote the age input box legislation, they want to make everyone legally required to provide Meta with their age.
  - pocksuppet 7mo ago
    No actually it's not mandated to be accurate
IX-103 7mo ago
The GDPR is vague and unworkable as written. It fundamentally restricts all data processing with a few, vague exceptions. What is data processing essential for the services being provided? Many publishers assumed that getting paid was an essential part of providing a service, and it was not until 3 months before the implementation deadline that the committee clarified that getting paid is not included when you are being paid by a third party. How are you to know whether or not the user is an EU citizen (and thus subject to the GDPR)? Is making that determination a service essential for providing your service? The answers apparently were "You don't" and "No", which would effectively make companies assume that the GDPR applies to everyone on the planet. The GDPR also is fundamentally opposed to how things currently work in the internet, making almost all advertising on the web illegal overnight. It was too big of a change to happen at once, so it effectively only loosely enforced in practice. I like the idea of the GDPR, but the implementation sucks.
- GJim 7mo ago
  > The GDPR is vague and unworkable as written. It fundamentally restricts all data processing with a few, vague exceptions. What utter utter FUD You are free to collect as much personal data as you want, PROVIDING you have my explicit opt-in informed consent to do so. What about this is difficult to understand? > How are you to know whether or not the user is an EU citizen (and thus subject to the GDPR)? The GDPR provides _basic_ data safety and consumer protection. If you aren't protecting users private data regardless of where they live in line with GDPR principles (such as collecting it fairly, and not selling it to randoms) then you are playing fast and loose with your users private, sensitive data. In which case you need to _seriously_ consider if what you are doing is ethical. > The GDPR also is fundamentally opposed to how things currently work in the internet, making almost all advertising on the web illegal overnight. Utter Bullshit! You are free to advertise as much as you like! But if you want to track me with your advertising (hello scummy adtech industry) then you need my explicit informed consent to do so. And so you should! Again, what about this is difficult to understand?
  - ryandrake 7mo ago
    > If you aren't protecting users private data regardless of where they live in line with GDPR principles (such as collecting it fairly, and not selling it to randoms) then you are playing fast and loose with your users private, sensitive data. It's interesting and revealing when someone responds to a law that says "You're not allowed to abuse users in countries X, Y, and Z" with "How can I figure out who's in the other countries, so I can abuse them?" instead of "I'll just stop abusing everyone, and then I don't even need to worry about where anyone is." Whenever you find yourself asking "how do I toe as close to the 'illegal' line as I can without technically going over it?" I think it's time to ask yourself some pretty hard questions.
    - troupo 7mo ago
      Your entire reply is both a non sequitur, and doesn't even attempt to understand what people tell you
kentm 7mo ago
> It's so wild that HN dunks on it so much: Here we have a societal problem in computing we've been complaining about for decades, someone offers an incremental but imperfect regulation to start taking steps to correct it, and everyone hates it! YOUR collection of user's data is an overreach and breach of privacy. MY collection of data is absolutely necessary to grow my scrappy small business and provide value. I am a good person with good intentions, so its OK. You are a bad person doing bad things, so its not OK.

ch4s3 7mo ago

Being able to read something in one sitting doesn't make it simple or obvious. The law establishes a board that gets to set new requirements.

stavros 7mo ago
As someone who has to implement it, it's really not bad at all: Ask the user for consent to use their data, and don't be misleading about it. That's it. The rest of the "It'S So LaRgE AnD UndErSpEciFieD" is just FUD. The regulators don't just slap fines, they work with you to get you to comply, and they just want to see that you're putting in the effort instead of messing them about. I have literally never been surprised by the GDPR. Whenever I thought "surely this is allowed" it was, whenever I thought "this can't be allowed", it wasn't. For everything in the middle, nobody will punish you for an honest mistake.
- redwall_hp 7mo ago
  Anti GDPR people: "it's so complicated not being able to walk into someone's house and take their things! Which things can I not take? How about this? And now I need a lawyer if I take someone's things? Ridiculous!" Just don't spy on people.
  - stavros 7mo ago
    Yeah that's pretty much what it feels like, or sometimes it's "what if someone's stuff is lying on the street? Can I take it then?" and the regulator is kind of like "look around and ask if it belongs to anyone, and if not, sure".
- ch4s3 7mo ago
  > for everything in the middle, nobody will punish you for an honest mistake. How do you know that? Again the law establishes a rules making body that can at any time change or add rules, and as far as I can tell there's no public review process.
  - 7mo ago