Hacker News Reader

Comment by gdfasfklshg4 | Hacker News Reader

Is this model actually GDPR compliant?

EDIT Either way I definitely don't want to trigger another conversation on the ethics of script/tracking/ad-blocking. I am wondering if this subscribe-with-your-data model is legally compliant with the GDPR. This is not a moral question (or at least I am not interested in a moral answer).

View on HN

Without answering that question, just block scripts on the site and everything loads fine.

Really? I get a blank page (umatrix with only first party images and css enabled).

Might depend on the specifics. I'm using Brave -> Lion Icon -> toggle Scripts Allowed to All Scripts Blocked. As an aside it also saves those settings per site making it quite convenient!

No, it is not legally compliant. It maybe has lost a little bit of value to actually discuss this as it's been done so, so much. If you are very interested in what is and what is not compliant, you can read the resources published by the EU on the GDPR. They are very legible and relatively easy to understand.

Thank you for answering. I assume you are a subject matter expert qualified to interpret the legal documents?

I have actually read some of the resources AND been there whilst customers received advice from lawyers. From what I had understood this model looked dubious.

I have not seen a discussion of this that didn't just end up in talking about morals. Even excluding this I really only wanted input from experts - answers from actual lawyers about GDPR have surprised me compared to what developers had assumed about it...

NB If I had a customer that proposed this model I would still insist that they consulted with their own legal advice before proceeding!

For various reasons I am and have been deeply embedded inside the process of making a medium-large sized business (if you really look you may be able to figure out which one it is - in case you do: My opinions are my own and do not reflect those of my employer in any way, shape or form) GDPR compliant. I have heard proper lawyers explain the terms to different kinds of people and found their conclusions match my own, coming from the literature. I feel like that allows me to talk a little bit about what this legislation means.

Given what you have said, perhaps the literature is not as obvious as I thought. As far as this model is concerned, it would not be compliant with the law as I read it and as I have had it explained to me. I don't deny that a party with enough money might be able to muscle a reading into existence that allows them to do this anyway, but that is I think an established risk of the legal system. For now we must operate with the law as written and broadly interpreted inside the EU.

> you can read the resources published by the EU on the GDPR. They are very legible and relatively easy to understand.

Reading the guidelines is not the tricky part of GDPR. The hard part is: "I have a website, am I compliant or what do I have to change to become compliant?" Mapping the guidelines on to real world systems is where the difficult analysis comes in.

I was implying that this was not complicated because I did not find it complicated. I have since learned that this was a lack of empathy on my part.

Don't beat yourself up! I think the problem is that there is so much FUD and inaccurate groupthink around GDPR issues. Whenever I have spoken to subject matter experts they have pointed out what you did that it actually is not that complicated.

But I guess that the average lawyer knowledgable on GDPR issues would struggle to sort an array even in O(n^2) time so what do they know...

I.e. all things are simple to those that understand them!

Reply on news.ycombinator.com