Hacker News Reader

Comment by jordigh | Hacker News Reader

I always read that "we really need your personal data for no good reason but the EU won't let us, god bless America!"

It really should be a 500 error, not a 400.

Edit: Listen, USA, it's not so difficult, and we all really need to stop siphoning off everyone's data like it's no big deal, laws or not. I wrote some stuff for the GDPR, just had to remove some emails from our database, and honestly, we shouldn't have been collecting them in the first place and neither should you. This surveillance capitalism we're all building is not a good thing and you should not be complicit in it.

View on HN

How familiar are you with internet laws in Malaysia? Because that is probably about how relevant EU laws are for a publisher for a small city in Wisconsin, normally. Until they make the front page of hacker news, that is. Whoever maintains their site is probably very confused at the moment, unless they are a HN reader themselves.

I read it "We don't want to be dragged into anything and your region is hardly a customer anyway."

Or possibly your foreign laws have made it impossible for us to determine if we are in compliance & it’s not worth it to figure out for a hyper local publication whose income comes from local ads.

Or alternatively, they’re saying that the legislation is so confusing that figuring out how to abide by it is not worth the risk and cost.

"It is difficult to get a man to understand something, when his salary depends upon his not understanding it."

It's not exactly complicated. Either get rid of their tracking cookies (why does a news website need tracking cookies to view an article?), or get consent before they use them.

People don't want to stop tracking their users and so they feign like it's some insanely complex law. It's not complex at all, it's just one that made the thing you used to do illegal, and you need to stop doing it, or get consent before you do it.

If maintaining a persistent session is somehow in the user's interest (say, maintaining an account at a store or online forum or something) then that's a legitimate-business-use exception. If it's for tracking/advertising/etc, then ask for consent, or presumptively don't do it. It's really not complex at all, unless you're being aggressively ignorant about it.

I am no expert, but I highly doubt it is really that simple, especially if the webmasters are particularly risk-averse. And why wouldn’t they be, if Europe is a relatively small portion of their user base? Why pay for an hour of a lawyer’s time, or even an hour of an employee’s time, to attempt to read and evaluate the laws?

It doesn't seem too complicated. Recital 23:

> In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. 3Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.

If this local newspaper isn't offering translations in French or German, and isn't offering subscriptions in Euro or GBP, then they're not ofering services to Europe.

I didn’t mean to imply that the complicated part is determining whether the service is being offered in Europe. This website is apparently already determining who they consider to be would-be European customers. They’re just choosing to serve an error page, rather than serve a law-abiding version of their service.

> Data subjects have the right to request a portable copy of the data collected by a processor in a common format, and the right to have their data erased under certain circumstances.

With ad networks and IP logging does this requirement of erasing and copies become more onerous?

> or get consent before they use them

The only effect the gdpr have is creating endless popups on all sites to accept cookies.

This does not make any sense, because browsers already have setting to block cookies, and users that had even a slightest in cookies had opportunity to use one of many browser extensions to further control the way cookies were stored.

I see gdpr as an effect of beurocrats not understanding the field they are trying to regulate, and trying to implement the wish of a vocal minority.

To address comments of the type "It is difficult to get a man to understand something, when his salary depends upon his not understanding it." I have never worked for a company that uses adds or tracking cookies in any way.

The irony is, popups to accept cookies are not GDPR compliant, unless there's an opt-out option. You cannot force tracking on someone as a condition of loading your website.

(you can, of course, serve generic ads instead, if they opt out, or serve generic ads by default and not show a popup at all)

> Edit: Listen, USA, it's not such a big deal, and y'all really need to stop siphoning off everyone's data like it's no big deal, laws or not. I wrote some stuff for the GDPR, just had to remove some emails from our database, and honestly, we shouldn't have been collecting them in the first place and neither should you. This surveillance capitalism we're all building is not a good thing and you should not be complicit in it.

This is incredibly patronizing. If I build a website in Canada, host it in Canada and primarily target it toward Canadians, don't complain when I have zero interest in learning about EU laws. I don't want to put a cookie popup on my website. I don't want to research GDPR. I don't want to worry about EU copyright law.

I just want to build a website for my users.

> If I build a website in Canada, host it in Canada and primarily target it toward Canadians, don't complain when I have zero interest in learning about EU laws.

You don't need to learn about EU laws, your product isn't covered by GDPR and all that will happen if your product somehow does fall under GDPR AND if it's non-compliant is that a bureaucrat will write a letter to you to either asking for more information or explaining how it's not compliant with suggestions about how to bring it back into compliance.

You may be right, but you're missing the point.

The hypothetical Canadian webmaster probably hasn't seen this comment. If they have, they don't know you, and have no reason to trust your judgment about EU law. They could research it themselves, but that takes time.

Most likely they have literally no idea what GDPR says, and don't care. So they just block the tiny proportion of EU visitors. Which is a completely rational -- it solves their problem at no cost to them.

It’s somewhat tricky. I operate a discourse instance. I have absolutely no desire to collect any personal information on my users(it is a free website and I am an anarchist), but I also live in the US and haven’t looked in to GDPR. The website is a hobby. I pay for the severs myself and do not display ads or use any tracking. I don’t intend to violate GDPR but I don’t know what it’s impkications are. For now I continue to make the site available for all, but if I felt there were legal implications to including Europe, I’d have to decide whether to block that region or do my due diligence. I’d want to include Europe given the subject of my site, but it’s something I haven’t looked in to yet.

I do sometimes view sites that make a big deal out of it as whining, but I admit that I’m not familiar with what compliance requires.

This scenario doesn't get enough attention and sympathy. Things have been going downhill with internet freedoms for a long while, with tech giants usurping content and the way we navigate the web etc. But, living in Sweden, I had not felt such a blow to my freedoms as when these signs started popping up, pretty much over night.

Europeans especially seem to be quite alright with this law since it supposedly only protects them. But a regulation is always, by priciple, a resitriction on some freedom. The GDPR may in fact be quite benign, but to me it's an obvious slippery slope where it is not hard to see this thing indeed evolve into something like the firewall of China. The EU is transparently considering protectionism with things like railways and telecom where foreign nations want to invest in the EU infrastructure. It's naive to think anything else of the internet. The GDPR was the innocent first baby step towards the European Wide Web.

GDPR only matters if your business is based in Europe, or targets European consumers in some substantial way. If you run a Madison, WI local newspaper, you don't need to choose between blocking EU users and following GDPR. You just ignore it and nothing will happen.

To me this seems like the reasonable answer. I guess I don't understand why this Madison website would even care about EU users or GDPR and why it would bother blocking visits it thinks are from the EU?

Because they don't want to get bogged down in EU law? I've had clients with real cross/inter/multi-jurisdictional issues. This would not be one of them.

Right - my point is that a lot of non-EU businesses over-reacted based on a poor understanding of the GDPR. Maybe their CIO read a blog post about American company X closing themselves to European customers, because they truly did attempt to market to Europeans and didn't think complying was worth it, and said 'Well, it ain't to hard to geo-block the EU' and went for it.

"It is so simple! They just need to not have any cookies, advertisements, trackers, A/B testing, email signups, or javascript!"

In your view of the internet, how does a site like this exist?

You do realize that static web-sites is what the internet was built on, right?

It does work! And frankly, it‘s very well suited if all you want to do is display an article.

Maybe i was woooshed here, not sure.

That argument seems to me akin to insisting the internet remain a platform for hobbyists and non-profit organizations. How does this site stay running and pay employees in this purer internet?

By enabling people to subscribe to their content if they deem it worthy. Maybe have a free section where you serve static sites and for your more "in-depth" articles or whatever you make it subscriber-exclusive.

I didn't want to argue we should revert to the internet of the 90's, but saying "how could you ever put anything on the web without cookies, tracking, data gathering?!" seems disingenuous when the internet was literally built without that.

EDIT: Oh, I get it now. We just had different interpretations of what "exist" meant :) For me it was just "a site on the internet that can be reached by other people", for you it was more about the economic viablity. Fair point.

Reply on news.ycombinator.com