Hacker News Reader

Comment by cobookman | Hacker News Reader

The joke is that nothing is gdpr compliant.

I've not met 1 company who met all aspects of this law.

I'd guess this also means that any asset in a 3rd party CDN would be non compliant with gdpr

When nobody is compliant, the regulating authorities can pick whoever they want to prosecute, including favoring turning a blind eye towards local companies and targeting foreign companies.

The GDPR is Working as Intended.

Or, you're projecting your ideology and expectations on something that hasn't even been around long enough to see how it's working.

generally, its not smart to experiment with an entire continent at a time

There is no major european internet company worth speaking about, so I think they probably don't care if it irreparable damages their own local companies in the process of damaging the foreign ones since they are virtually non existent anyhow.

Ironically the foreign big ones have enough resources to comply to the law, small local ones don't and will die/never be created in the first place.

> the regulating authorities can pick whoever they want to prosecute

It doesn't really work that way, at least not in germany, anyone can just sue (or threaten to sue) their competition over this (they already started) there is no such thing as this mythical benevolent authority who could stop this wanton destruction you are talking about.

> anyone can just sue (or threaten to sue) their competition over this

This is wrong. Competitors (and only competitors) can send a cease-and-desist letter based on competition law, because ignoring GDPR gives an unfair advantage - even that only in Germany because the tool used here ("Abmahnungen") are a unique german thing.

They are also a common thing between companies that don't "like" each other and if you send one you can expect to get one back. Receiving one costs ~1000 € (goes to the opposing lawyer) so they don't hurt much and the only one profiting is the lawyer.

Yes competitors have an unjust advantage if they don't comply with GDRP and you can take legal action against them. There is no authority that goes around deciding when this actually makes sense or is harmful to the economy. Which was my point.

> the only one profiting is the lawyer

how would I not profit from my competition having to pay money, I don't care if I get the money.

> Ironically the foreign big ones have enough resources to comply to the law, small local ones don't and will die/never be created in the first place.

Yep, that's what I've been saying all along, but people don't seem to understand.

The real cost of regulation isn't the cost of non-compliance and the punitive measures that follow. It is the cost of compliance, reporting, addressing an endless stream of complaints and requests for information.

Large companies have the resources to handle that, small ones don't.

The alternative to the GDPR was endless and increasing harm to users. The "invisible hand of the market" couldn't find a solution. So now we have regulation.

This is the world we live in. When the market fails to protect users, eventually there might actually be consequences.

So constructively, how do we solve this CDN problem while causing the least harm to both businesses and users? Perhaps identify assets by cryptographic signature rather than URL?

Can you explain what harm is being caused to users by accessing fonts off a CDN?

It potentially opens them up to tracking by whoever operates the CDN.

Sounds like FUD. You can say this about any web server. Also, "tracking" doesn't imply actual harm or abuse.

Is anyone dealing with 3rd party script/image loads at all? I just loaded a bunch of different major websites while watching the network tab in Firefox, and there wasn't a single site that didn't load ads and other assets from 3rd party domains. And that's before the "do you accept cookies?" prompt, assuming they have one at all. On most sites, it seems like it would be easier to list the advertising networks that aren't used than to list the ones that are used.

Wouldn't using cloudfront be compliant, because it's your bucket? Turn off the logs, then it's anonymous. Or did I miss anything?

IANAL but I think you still need to sign a data processing agreement with them and have your users confirm that they'll have access to their data.

Does Amazon do unreasonable things with your users' data? Because otherwise you wouldn't need consent.

The terms are broad in GDPR, so you need the DPA just for Amazon to store it, as that's "processing". However, you don't need your users to confirm that, they agree to share the information with you (controller) and you'll have some sort of terms in your privacy policy allowing you to share personal information with 3rd parties you regularly interact with for legitimate purposes who will be bound by the terms set forth in your own privacy policy.

It may be your bucket, but Amazon is still a third party. Does turning off logs disable all logging on the Amazon side, or just your copy of those logs?

You really think Amazon doesn't have logs for security and troubleshooting?

What about all the networks between you and Amazon?

No, you still need a processing agreement with Amazon, but that's not a problem.

your own bucket wouldn't benefit from browser url-based caching of common assets (libraries, fonts, etc)

have a Data Processing Agreement with the CDN, like with any hosting provider you use, spelling out a reasonable policy for what they do with your users data. Mention them in your privacy policy. Which Google could just offer as a self-service thing for Fonts, since it doesn't need any customization. And suddenly your use of the CDN is compliant.

Reply on news.ycombinator.com