Hacker News Reader

Comment by sjcsjc | Hacker News Reader

"Unfortunately, our website is currently unavailable in most European countries. We are engaged on the issue and committed to looking at options that support our full range of digital offerings to the EU market. We continue to identify technical compliance solutions that will provide all readers with our award-winning journalism."

View on HN

At least they aren't pretending to comply with the GPDR yet blatantly violating it, for example by making it difficult or impossible not to opt-in.

Google cache seems to be the easiest method to view it:

http://webcache.googleusercontent.com/search?q=cache:hcp4U0t...

Weirdly I assume then accessing via google cache does comply with the GDPR (otherwise they could of course block google via robots.txt).

From memory, google cache still fetches assets from the original site (and I think also triggers Javascript?) so it's possible this is kind of moot?

Guess the issue is similar, if I access from Europe via a US proxy. I'd assume those accesses are still covered by the GDPR, but it's not clear to me. Anybody know?

You are breaking a US law - CFAA. Which could be an interested showdown CFAA vs GDPR.

How is CFAA being broken here?

I think the joke here is that some people argue that usage not permitted by the terms of services is a criminal offense under the cfaa

I don't agree with this interpretation but I think cfaa is unsalvageable nonetheless. I demand a full repeal!

https://outline.com/NghkCV

Wow, not only this bypasses the GDPR wall but the experience is much cleaner. Thanks.

Is outline.com legal?

as legal as Google Cache, probably.

Google Cache respects paywalls and robots.txt, it seems Outline does not.

In what country?

Running the Chrome extension on your own device? Yep that's OK. But republishing full articles on the web accessible to all - no chance. They have a DMCA link at the bottom to "excuse" themselves.

What if you use a Chrome extension to train a ML model to format the article, then publish that model back to the web? At least it would allow users to remove ads and other cruft from articles.

So, the fragmentation of the internet has begun...

Previously you've had to use the likes of tor to reach the dark net, now, I guess, non EU IP is enough. Same divided internet, only the boundary is moved.

Begun? Surely you remember Youtube region locking videos. Or companies that don't offer their services (or have different) outside of their region opening international sites that have different content in different regions.

This is nothing new.

So it's not negative that right after we stopped doing it with videos, we are doing it with everything? I'm European. I just want to use the Internet, all of it; please, EU, leave me alone, I can handle my data by myself more than well enough.

Then go ahead and allow the companies to use your data. No one stops you. And leave the rest of us alone.

AFAIK, the GDPR explicitly makes it illegal for a company to operate on a “pay with your data” basis. So no, they can’t.

So are we going to lose access to Google and most other services? Because they are effectively "pay with your data"

If gdpr had its way, then yes, you would probably lose access to google and pretty much the rest of the web. Right now, most companies are skirting around the law though so we will have to wait and see the real effects once the lawsuits start settling.

How so? The users just have to give their consent for it.

Because you can't have access to the service conditional on the consent.

I'm unable to access this website. I can't let them use my data, GDPR is stopping me because compliance is apparently too expensive for this site. I don't have any option to click on a "I don't want any GDPR-provided 'rights'" button or e.g. sending such header with my requests.

Even worse, and more surprising and alarming, a few weeks ago the Humble Bundle was selling region-locked EBOOKS! Someone explain that one for me, please. This means I wanted to buy a bundle of sci-fi books -- that's buy, not read for free -- and all of the most interesting books (old classics, by the way) were "not available in your region".

edit: a clarification: the ebooks themselves don't have DRM, but Humble Bundle will refuse to sell them to you if you're in whatever region they (or the publishers) don't want to support at the time.

Say what now?

And did Humble Bundle support fix your issue?

Man, I remember when a major Humble Bundle selling point was being DRM free...

If it's like previous times I've seen this, the ebooks themselves will still be DRM-free, HB just won't sell some of them to you i.e. they won't be included in the bundle you get.

Yes, thanks for clarifying. This is still tremendously disappointing. They show you the books in the bundle, but refuse to sell them to you. I wonder how this is a thing. It certainly lowered my faith in the Humble Bundle.

I'm sure it's a distribution rights issue - probably someone who didn't want to deal with Humble Bundle owns the book rights in those regions. As a non-American I see it all the time with media.

I'm sure it is too, but IMO Humble Bundle should refuse to carry books with those restrictions.

I explained myself badly. It's like commenter mrec said: it's not that the ebook itself has DRM, but that they won't sell it to you, with the message "unavailable in your region". Very disappointing.

Well, we had piracy in the 90s, and if some greedy CEO wants to support a revival of that tradition..

https://web.archive.org/web/20180606080053/http://www.latime...

Why would a news magazine website do this? Is it their ads that violate GDPR?

To completely block EU users to me at least implies greater degrees of data collection.

Why? Many other news websites simply force you to opt-in, which is illegal. It seems ad analytics are vitally important to their business model.

It's not though, they can still sell subscriptions and show ads without violating user's privacy.

> they can still sell subscriptions and show ads without violating user's privacy

At risk of going off topic, there are two issues at play. One, respecting users' privacy. And two, complying with GDPR. The former does not always mean the latter.

And even if one complies with GDPR, having material over which GDPR applies could result in frivolous complaints and costly regulatory interactions. It is reasonable for a newspaper with a mostly non-Europe to spend resources on other priorities.

But they still have the data of European residents. So merely blocking access to EU residents hasn't done much to lessen their GDPR liability, unless they've cleaned all their data.

> they still have the data of European residents

Source? Ensuring the permanent deletion of certain data, once, is easier than implementing an a new and complicated compliance regime.

There is no source needed that is a result of jurisdictions and national sovereignty

If China passed a law saying you must now delete all references to Tiananmen Square if you have nothing to expoae yourself to their legal jurisdiction you can keep it and literally tell them to get bent.

This is what I don't understand. Why did the LA Times add the IP filter in the first place? Why do they care if they get sued and/or fined by a foreign country? Let the EU block their IPs or DNS themselves if they feel like it.

To make money advertising to EU users, most advertisers probably have some EU presence, hence the ad network would too. Thus, the ad network might require their users to be GPDR-compliant.

From what I have read about GDPR here, the intent matters. By blocking EU ip addresses, they have shown their intent to not service the EU and therefore are exempt from GDPR.

But I certainly don’t know how much that effects their income and I doubt you do too. Maybe it’s not worth it without the tracking.

Because they don't have the technical knowledge to ensure compliance with 88 pages of mandates, maybe? If you violate GDPR you will be fined by the EU even if you do not exist in the EU.

But why would a news website per se need to collect or process user's personal data? If you don't, you don't have to care about GDPR at all.

Um, to sell more profitable ads.

They probably feel that the non-targeted ad revenue they would make from EU customers would not be worth the server costs, costs to comply with the law, and potential fine costs (risk).

Maybe or it could be that they don't have a data compliance officer, which is mandated by the GDPR. Or it could be that they just don't know what the issues are and have no clue how to get compliant. IP addresses are protected data and make you a data controller if you have log files.

The point is that if you are exercising the law to it's maximum extent then it is next to impossible not to collect personal data, even if you have no intention to.

For example, some hosting providers in Europe now automatically disable webserver logs unless the customer explicitly activates them to make sure they don't accidentally collect user data.

Now you might say, well if you run your own virtual server where you control all the services and know for a fact that no personal information is collected you won't run into that problem. But then you might still collide with the law because some network monitoring of the hosting provider might store connection logs. And it is on you to make sure that the companies you use for your business are compliant with the GPDR. You even need to have a contract with every single one of them with which you instruct them to process your users data and that they have to comply with the GPDR when doing so.

And even if you think everything you are doing is correct there are still some law firms that try to extort money from you by claiming some violation. In Germany this game of cat and mouse has already begun (and I don't mean the well known cases against Google, Facebook et. al)

> extort money from you

This isn't the US. You can't sue for GDPR non compliance, only complain to the authorities

FUD

It's funny that they have the technical knowledge to implement tracking (or outsource it to another company), but they don't have the technical knowledge to comply with GDPR (or outsource it to another company).

I'm looking forward to seing the first non-EU company (that has no EU offices) fined by the EU and the middle finger that will ensue.

Yep, me too (France).

Reply on news.ycombinator.com