Hacker News Reader

Comment by downandout | Hacker News Reader

Honestly, the best thing to do if you don’t have a high percentage of EU users/customers is to simply block EU IPs. First it was the completely useless cookie notifications, now it’s GDPR, and nobody knows what the next thing will be - we only know that there will be a next thing (there always is), and that it too will be costly and burdensome to comply with. Unless you derive a significant percentage of your revenue from EU users, it just isn’t worth it to try to keep up with the increasingly demanding whims of a heavy-handed European government.

View on HN

That sounds ideal. Please make sure you do this, and convince many of your colleagues and compatriots to do the same. Maybe finally give us some breathing space to grow our own popular services in the face of US dominance.

I used to think protectionism was stupid, but after seeing how The Great Firewall[1] is working out for China and their services, I’m not so sure anymore. The big problem with any inbound restrictions is retaliation, but if you can manage to make a country restrict exports themseleves, well, yes please!

I’m looking forward to seeing EU competitors flourish.

[1] Since visiting China I’m convinced TGF is about protectionism as much as it is about filtering. Internet to any non-China service is terrible and unreliable. The result is simply you can’t depend on it, so you choose a Chinese provider. This has clearly worked out very well for some of their companies!

The large US sites you’re worried about “dominating” the EU, who have significant EU traffic, will be able to comply with the GDPR and continue to compete just fine. They have the resources to hire the necessary phalanx of attorneys to advise them on how each feature and tweak to their sites interact with the GDPR, and it is a worthwhile investment for them. I was saying that smaller sites that don’t have internal legal departments and don’t need EU traffic should consider blocking EU IPs.

> Honestly, the best thing to do if you don’t have a high percentage of EU users/customers is to simply block EU IPs.

Could you please block my IP address as well: 192.117.111.61

If you feel that being responsible with my personal information and metadata is not worth the trouble, then I don't want to accidentally ever use whatever service you maintain. Thanks.

What an absurd statement. This isn’t about being able to be “irresponsible with [your] personal data”. GDPR compliance is a difficult, expensive, onerous, and uncertain endeavor. Sites that don’t rely on EU visitors for revenue don’t need to expose themselves to the additional liability that the GDPR imposes.

That doesn’t mean that sites that haven’t gone to the expensive lengths required under it are going to expose or abuse your data. If you are this big of a fan of the GDPR, I imagine that you’ll have to limit your Internet browsing only to sites run by EU-based companies that are large enough to afford scores of attorneys to advise them on how to comply.

> If you are this big of a fan of the GDPR, I imagine that you’ll have to limit your Internet browsing only to sites run by EU-based companies

That is a terrific idea, thank you. In fact, for sites that require providing much information (email providers, etc) I'll start doing just that. Though HN does not require much data, I will review how the site intends to deal with GDPR.

I'm a big enough fan of the GDPR and a big enough opponent to SESTA/FOSTA/CLOUD that I have moved almost all my business into the EU. The only remaining US business I depend on my DNS provider.

Why should I trust a US business with my personal data when I can give it to a EU business that will face harsh punishment for doing bad things with my data (the US seems to have no problem with large corporations loosing millions of user data entries as long as the big CEO says "oops, sowwy!")

>What an absurd statement. This isn’t about being able to be “irresponsible with [your] personal data”. GDPR compliance is a difficult, expensive, onerous, and uncertain endeavor.

Being responsible with someone's personal data is inherently difficult, expensive, onerous and uncertain.

The idea handling personal data wasn't already all of that is exactly the abuse that got us where we are today.

The EU has a population of over half a billion people and a GDP per capita of $41k PPP (although those numbers will shrink a little bit post-Brexit). Ignoring Europe as a potential market ignores half the western world - and it is westerners, for the most part, who have disposable income to spend money on goods and services.

Ignore Europe if you like. Just be aware that you are allowing your competitors to gain an uncontested foothold without having to fight for it. Once they are the incumbent in the European market, they will be hard to unseat, even if you change your mind later.

There are thousands of types of sites, such as geographically focused message boards, local professionals, smaller ecommerce sites, etc. who are exposed under the GDPR but for whom EU traffic is incidental and worth nothing. A US plumber doesn’t need or want appointments in London, but is technically exposed under the GDPR. So for businesses like this, blocking EU traffic should be an easy decision - there is no downside.

IANAL but I believe the GDPR is tolerant of incidental traffic. So if an European accesses a local job board in South Korea, the EU will not go after the Korean company and demand compliance. Now if said Korean company is running a job board for Berlin, in German, charging in Euros, etc. it's a different story.

That, along with many other parts of the GDPR, is both open for interpretation and may vary from country to country within the EU. See https://aristilabs.com/how-the-gdpr-apply-to-your-us-based-c...

That shouldn't be an issue. If you offer your services only within the US then you're out of scope. It doesn't matter if EU citizens visit your site, as long as you don't try to get any customers from the EU or target your content towards visitors from the EU you don't have to comply with GDPR.

For most American pubs - and hence producing English language content -- there's very little risk. Most of the EU won't read it anyway, and if the uk privacy regulator wants to complain, let them.

> First it was the completely useless cookie notifications

It was useless in the sense it was trying to play nice. It was a gentle call for the industry to self-regulate. The only problem with that law was how naïve it was.

Go ahead and block the whole European IP range. See if we care.

You do care. Everytime some web service is US only there's endless ranting from Europeans about it.

That's because, most of the time, a service is US-only because of some bullshit reason like exclusive region-locking deals or MAFIAA copyright terrorism. I don't think that "this service is unavailable in your country because your law doesn't let us sell your private data to the highest bidder" is going to induce that much ranting.

Once blocking by US websites becomes a little more widespread there will be EU alternatives to fill the gaps. Normally I'm not a huge fan of such solutions, but if the alternative is exposing myself to the wild west of unregulated selling of my personal data that is the US I'll learn to live with it.

The cookie law was also largely overblown. It only require notifications for any non-essential cookies and I think the wordpress plugins for this simply put up a blanket banner because the blog author might just be using the Google Anal ytics plugin too.

And then everyone put it up "just in case" or "because the law says all cookies". (Of course some smart people figured out that local storage is not a cookie and the law only covers cookies, atleast what they gather from hearsay instead of checking the actual text)

But tbh, I'd prefer US services IP blocking European users. It'll encourage EU startups to fill the gap and they will have the privacy regulation of the EU as marketing bullet point over any US company, eg "In the US privacy is a pinky-promise, for us privacy is law".

Ehhhh, I'd leave it as is. Unless you have business licenses in EU countries, EU laws have no legal authority over you. If you do have such licenses, then you're probably big enough to foot the bill and possibly also can't afford to not foot the bill (due to suspended licenses).

This privacy thing is, like, their option, man. Even if you and I agree with the EU.

I’ve been looking into this, as I run several sites myself, and apparently this isn’t true. They can go after you even if you have no EU presence, and US courts will domesticate any EU judgment against you for fines levied under it.

Do you have a source on this? Seems like a major concern if true.

Several, but this one explains the issue most succinctly:

https://aristilabs.com/how-the-gdpr-apply-to-your-us-based-c...

"Under Article 3 of the GDPR, your company is subject to the new law if it processes personal data of an individual residing in the EU when the data is accessed....the GDPR can apply even if no financial transaction occurs. For example, if your organization is a US company with an Internet presence, selling or marketing products over the Web, or even merely offering a marketing survey globally, you may be subject to the GDPR."

With regard to enforcement....

"...EU regulators rely on international law to issue fines. Written into GDPR itself is a clause, stating that any action against a company from outside the EU must be issued in accordance with international law."

Most US states have adopted the Uniform Foreign Money Judgments Recognition Act (UFMJRA), which allows for judgments issued by foreign courts to be domesticated. Once that is done, the judgment carries the same force and effect as if it were originally issued by a US court.

It's not true, but something that is bantered about on HN by people that wish it was true.

Think about it. If it was true, then the entire global legal system would get very chaotic.

Frankly, the political agenda by people telling these lies is quite tiresome.

Just ignore them.

It's interesting that I posted a source for this 5 minutes before you posted this comment.

And since I can't reply to the parent directly, I'll just say that there is no international law that covers this. None, zilch, zero....so anybody says that you're somehow beholden to GDPR when you have 0 presence in the EU is either lying or ignorant of the reality.

So basically we create a law to protect user data and your answer is "let's only work with countries that think messing up with my users is ok" ?

It’s not about being able to “mess with [your] users”. It’s about sites that don’t need EU traffic anyway being unnecessarily exposed to fines for even accidental violations of a very complex law.

Btw. same goes the other way around: if you don’t want or need US customers, it might make sense to block people from the US based on IPs, because if you do business with US citizens, they can sue you according to US laws with their ridiculous high fines.

But any of your sites should protect user data, it's the respectful thing to do. Right ?

In which case would you you think it's alright for any site to not protect, say, a user home address ?

Reasonably protecting user data and complying with the GDPR are two entirely different things. There are many ways to accidentally run afoul of this law while still protecting user data.

Define "reasonably", because what I see in the wild as a freelancer is 9 times out of 10 not matching what's "reasonable" to my standards.

And what are the "many ways" you can "accidentally run afoul of this law while still protecting user data" ?

It's hard for me to grasp.

(I'm not the one you replied to.)

I'd like to see a complete and concise list of exactly what needs to be done to comply with GDPR. Everything I've seen so far has been vague legalese open to subjective interpretation. Pretty scary when the punishment for an incorrect interpretation is a 20M EUR fine.

simply block EU IPs

A lot of us who admire what the EU has the courage to do - and wish that the US had half that courage - would rather disappear from everything but European websites. What many US corporates have done, and are doing, is rotten to the core. It is demonstrably destroying the internet that so many of us spent time bringing to life, and had so much hope for.

I suspect that if someone with some balls and power suggested corraling all US trackers and data brokers - along with companies trying to turn the net into a shopping mall - into a single domain outside of which they could not operate - most Americans would applaud. The EU has done some of what it could, and cheers to them for having the courage to serve their citizens. Wish I was among them.

Better yet, comply and get your privacy/data management chops together so that you're comfortably able to navigate a world where this type of legislation is likely to become more and more common. Not to mention the fact that there's an increase in interest/awareness about these matters amongst the general public.

I love this comment. Waiting for people to take the bait and reply to you!

Take the bait? I’m not saying anything controversial. A large percentage of websites are directed at the home country of their owners anyway, and EU traffic is often incidental and worthless to them. A US dentist or doctor likely has no interest in receiving appointments from people in the EU, for example. An online store based in the US, who would have to charge outlandish shipping rates to ship to the EU, is unlikely to get orders from the EU and thus should have no interest in that traffic. An online message board where nurses in a US city talk to each other probably wouldn’t want to spend the money to comply with GDPR even if the occasional nurse from the EU might pop in with an interesting comment every now and then.

So EU traffic means nothing to any of the above example sites, yet all of them will be massively exposed under the GDPR. If I ran a web hosting company, I’d offer EU IP blocking as an optional, free service.

You don't think it's controversial to tell business to block the other half of the civilized world?

Reply on news.ycombinator.com