Hacker News Reader

Comment by merijnv | Hacker News Reader

What part of the GDPR makes things difficult for your side business? Every discussion I run into has people claiming this sorta thing, but my reading of the text make it fairly clear that for 90% of non-despicable use cases there's really not that much of a problem...

View on HN

My "despicable" side business is (was) making Android apps with Admob ads. I needed to update my app to allow EU users to opt out of targeted ads. Why Admob doesn't just add this functionality to their widget they place in my app is beyond me. In order to update my apps, I need to target a newer version of Android. It's not that it's very outdated, they were targeting Android 5.0, and get updated every 6 months or so. But a change in the Android API has made this very difficult for me. Being a side business, I had to make the choice - let go of the $600/mo I was making from ad revenue, or continue with the constant barrage of code updates required from Google for my apps to work. I decided to let it go. My app would still be on Google Play, even though I couldn't update it, if it weren't for GDPR. They pulled it due to non-GDPR compliance. So, yeah, GDPR has costed me $600/mo. I'm sure there are a lot of others with complex stories about how these regulations affect them. BTW I support GDPR and privacy as a whole, and wish my native USA would take privacy more seriously. It is the details of the implementation that are lacking. I also suspect that Google uses policies (such as putting the burden of Admob GDPR compliance on the publishers) to try to push out small developers.

So, this has nothing to do with your business, and everything to do with admob illegally spying on your users.

I mean, I empathise with your problems, but this very much doesn't sound like "GDPR makes by side business impossible". It sounds like "exploitative user-data abusing ad vendor abuse s their lock-in to exploit people's personal data" kind of problem, so I'd say things are working.

FYI, "allowing EU users to opt-out" is still wrong, they would have to explicitly opt-in to targeted ads. At least, in so far as ads are targeted based on personal data.

A client, a large pharmaceutical company, asked me to remove everything that could potentially violate the GDPR from their Android / IOS app. Apple rejected the update despite me stating the reason for the update, because the app could have been a website instead. Some of the functionality I had to remove was mobile specific, like reading measurements from a medical device etc.

I mean, that's just shoddy reasoning or laziness of the client. If you make a medical app like that, you clearly have a lawful basis for processing based on the "contract" lawful basis. So the only issue would be taking care how it's used, and having a policy in place for handling that data.

My specific issue was the EU representative; as the sole "employee" of my company, I will not pay a lawyer based in the EU to represent European users with privacy / data concerns. They could just contact me directly.

Ok, that's one I'm willing to concede is annoying for single person companies and there should probably be some fix for dealing with that. On the other hand, I understand why a legal representative within EU jurisdiction is desired.

For the record, your EU representative isn't required to be a lawyer or even legal expert, though.

Reply on news.ycombinator.com