Hacker News Reader

Comment by woobar | Hacker News Reader

Not just WSJ. It was in the news last week: https://www.wral.com/north-carolina-apple-negotiating-deal-o...

Wow:

"We are a local media company based in Raleigh, North Carolina, USA. We have detected that you are in one of the member countries of the European Union, which is now subject to the General Data Protection Regulation.

... Until we are able to ensure our full compliance with the rigorous GDPR requirements, we are blocking access from EU countries to our websites, which include wral.com, wralsportsfan.com, highschoolot.com and wraltechwire.com. We take the GDPR seriously."

I think that's great.

Isn't it great that they're taking it seriously, and ensuring that your privacy is protected?

Reap what you sow, Europer.

Seriously though, is GDPR compliance that difficult? What does a news site have to do to comply?

That's actually the worry. What are they doing with your data that they don't to be transparent about?

They don't know and don't feel like being in compliance with it. Laws like GDPR and specific sales tax laws net these kinds of results all the time in local businesses who don't gain anything by complying.

Just to answer that question can take more time from engineers and lawyers than it's worth for a small userbase.

If you're a small or medium sized non-tech publisher who outsourced the building of your digital publishing system 5 years ago and have been cruising along ever since, you might not be very motivated to spend real cash on a big new IT project to ensure your various server logs don't have IP addresses or other "personally identifying information" in them, just to name an example.

And, in this case, a local newspaper in a relatively small market. Their exposure is probably pretty limited but it's not hard to imagine a legal or compliance person asked IT is they were compliant with GPDR and the answer came back "dunno." At which point, the decision is between spend an hour to cut off EU access, decide to deliberately sweep any potential problem under the rug, or spend a fair bit of effort to do at least a compliance audit. #1 doesn't seem like a bad choice in this situation.

That's probably the issue. The news site itself doesn't have to do much.

But the ad code and trackers and beacons and all the other stuff that they have installed on each and every page - the news site has no idea what it's doing and how to even begin ensuring compliance.

They don't want to risk 4% fo global revenue to find out.

You can't be all that surprised, right? EU users are now a liability, so it makes sense to block them until you can be absolutely sure you can comply with their laws.

Nothing of value was lost.

On the one hand I think this is a great sign that the GDPR is being taken seriously. On the other, I see this as corporate speak for "We're not sure if ensuring compliance makes business sense for us and this notice may actually be permanent. You're from a region where anyone interested in our content is probably a long-tail outlier that won't make us much money, so ensuring access for you is not a priority."

I really hope that data privacy regulations don't have the unintended side-effect of significantly increasing the geographic balkanization of the web.

> We're not sure if ensuring compliance makes business sense

If that is the the case then it is working as intended. Instead of just ignoring regulation and writing off a small risk of some fixed and difficult to enforce fine as cost of business the "4% of global revenue" clause puts the fear of god into companies.

It will. Copyright protections do the same - I wanted to see an US-based SNL skit and it's blocked in my country.

BBC stuff is likewise blocked.

I find region-based blocks all the time :( , mostly related to IP and copyright.

Yep, just had that call yesterday: <0.1% of customers? Drop EU users off our email list and blacklist the EU until we want to actually target the market. Ended up not worth it to even check if we're compliant than to just lose the business, at least for the short term.

I don't blame them. I'm thinking about doing the same thing for a few of my web sites that have very local content.

The company that sells the advertising on those sites says non-US traffic dilutes the value of the ads, and I'd get 3-5% higher CPM if I filtered non-US traffic.

I've kept them open until now because I like to check on the sites when I travel, but GDPR might be the incentive I need to pull the plug.

> I'd get 3-5% higher CPM if I filtered non-US traffic.

3-5% higher CPM on how many fewer pageviews? In general, filtering out traffic should always make you less money, even as filtering to the most profitable traffic increases how much you make per page view.

If non-US traffic really were losing you money your advertising company could always drop ad requests from non-US traffic.

Non-US traffic is essentially non-revenue for many American web sites (unless you're running AdSense). Serving pages still costs money, though. So it makes more sense to block non-US traffic than to serve it ad-free.

> I really hope that data privacy regulations don't have the unintended side-effect of significantly increasing the geographic balkanization of the web.

It will without a doubt have that effect.

EU citizens are now a liability and simply not worth it. If you are in the EU except yourself to be blocked from large portions of the internet.

On the plus side for the EU, maybe now they'll actually get some internet startups catering to them, since non-EU options are no longer available.

Reply on news.ycombinator.com