Hacker News Reader

Comment by Mirioron | Hacker News Reader

I wish GDPR had some exemption for small companies or companies that are starting out. Maybe limitations on revenue, amount of users and scope of data, eg strict rules still apply (to a small company) when dealing with sensitive data such as health information, but email addresses are not as strictly governed. Perhaps require a plan of action to abide by the full rules by X future date even.

Take for example some one person indie developer. A common way to monetize that is through ads and in app purchases that turn ads off. With the current rules it's difficult for a single person to know that they abide by all of that while still monetizing in such a way.

View on HN

To me that sounds a bit like adding health and safety code exceptions for roadside food stalls.

It's more like not subjecting employees who bake cookies and share them with coworkers to the same inspection requirements as commercial kitchens whose entire business is selling food to the public.

Even moreso because one person distributing bad food can give a dozen others food poisoning, but the concerns with data collection come from mass surveillance and aggregation, which implies a scale that large entities have and smaller ones don't.

> not subjecting employees who bake cookies and share them with coworkers to the same inspection requirements as commercial kitchens whose entire business is selling food to the public.

A coworker baking cookies and sharing them with coworkers isn't trying to make money off of those cookies. A startup is.

The coworkers consuming those cookies are generally able to identify that the cookies were homemade, bakeshop, or industrial quality. Today we can barely even identify what is tracking us, let alone how, and definitely not why.

You're not comparing apples to oranges. You're comparing apples to bushes. Homemade cookies and startup personal information aggregators aren't even in the same league of category.

Also it feels like a slippery slope. Let's say the cut off is $25m in revenue. So you have some business ideas based on violating user privacy that are profitable, until the company reaches the size where it has to comply, and all of a sudden its unprofitable.

Clearly the next step is to lobby for raised limits, rather than companies planning in advance for what they'll do when they cross the threshold.

When I said small I was thinking more about <$250k a year in revenue. At that size I think the companies would be small enough that their lobbying wouldn't matter.

If you're in the millions a year in revenue then I don't see how understanding and complying with GDPR would be a large barrier. Even $250k might be too high.

Typical lobbying is completely the opposite of that. The companies who have the resources to do it aren't going to be inside the threshold between e.g. $25m and $100m and they wouldn't want to stay that size anyway, so what they'll do is lobby for a generic exception that isn't related to entity size at all. Or if anything is inversely related to it, so that the same large entities that have the resources to successfully lobby to change the law are also the only ones who can comply with the rules while simultaneously skirting their intended purpose.

And if you have a problem with corporations controlling your legislature then in general it doesn't do a whole lot of good to debate what some other law should be since the better law wouldn't be enacted by a legislature controlled by lobbyists anyway.

> A coworker baking cookies and sharing them with coworkers isn't trying to make money off of those cookies. A startup is.

You're implying that the rules only apply to companies whose line of business is selling data. There wouldn't be an issue if that were true. Making money by selling mugs on the internet where you also collect some customer data is analogous to making money by working for a company where you also distribute cookies.

If you can't handle data reasonably then you can't handle data. I don't see why the company size is relevant.

It seems like many small companies are also not run by people who have read in some business magazine or have been told by some consultants that they need to be doing big data. Unless they do advertising, they likely don't need the data in the first place and so the path of least resistance is to do the right thing. No data, no problems.

And if you don't do advertising how do you monetize? Do you follow all the other apps that implement gambling as their monetization strategy?

You do it while complying with GDPR, of course.

> if you don't do advertising how do you monetize?

Try making sales instead of providing a "free" product?

You might need data to increase your sales, though. But that parts needs not be unethical, nor leave your company.

Have you looked at how apps on the app stores are monetized? The only ones with a lot of success that charge upfront are big existing names or rare exceptions. Everything else that has success tends to be free. You can't compete with that, because somebody will just clone your app and release a free version of it with ads.

Surely there are ways to serve ads without collecting any user-specific data at all? Tada, compliance, and zero effort, too.

Of course there are. They also pay next to nothing and you're likely limited in scope in networks. Even then you need to be able to figure out that the ad network is actually keeping their promises. Remember that we're not talking about operations where you an just hire someone to do that. We're talking about operations where essentially you would have to figure all of that out and often take personal responsibility that you did figure it out properly.

Targeted affiliate marketing is far better than ads imo. Odds are that you’re catering to a subgroup with very specific needs (unless you’re trying to clone facebook). You can inform users about products that they might need, ideally in form of valuable content and just include links with your vendor identifier. No third party scripts whatsoever and ads the user might actually like and click.

Because this is a massive barrier to entry for Europeans. You either need to essentially be a lawyer or you can't run ads (or you break the law). Non-europeans can easily implement ads and combine this with in app purchases and what not. Europeans can't do that nearly as easily. They will get out competed. I don't see how you don't see how this is bad.

European here, both a consumer and micro-ISV owner.

As a consumer, I very much like the protections the GDPR provides.

As a business owner, I don't find GDPR to be a barrier to entry - TBH, anyone who actually cares about user privacy at all would have been near-compliant even before GDPR name in. For me, I think it was 1-2 days, most of it spent reading.

It's not difficult to comply with, and I'd be very against exemptions for small businesses - also because larger businesses would use it as a loophole to game the system.

You very much don't need to "essentially be a lawyer" to be able to include ads - services like AdMob have easily configurable SDKs for getting GDPR-compliant consent.

It's really no more than a few lines of code to respect user's privacy, and if you're collecting significantly more user data then you should be handling it with care.

> Because this is a massive barrier to entry for Europeans.

No. This is a massive barrier to people who aren't used to thinking about their fellow people.

I'm sorry but this is utter rubbish. The GDPR is easy to follow. If you can't think 9f how to run a business without being reckless or scummy, then you shouldn't be running one.

I work in the EU, in tech, with customer data, with these rules and have zero problems following them.

That would be way too easy to take advantage of by a big company making lots of small side companies

How would that work out in practice? Sounds highly unlikely.

Have you heard of contracting practices in the US? Rather than "highly unlikely", this is the norm for tech companies that want to skirt corporate responsibility.

That's an unrelated issue. In this context that could be avoided simply by counting more than half time individual contractors as employees when measuring entity size.

Splitting large companies into smaller ones to get tax breaks and other incentives is extremely common.

For example in the UK there are tax breaks for companies that spend more than a certain percentage of the revenue on research. Just below the threshold? Simple! Split out a research arm!

This is common because splitting a large company into five or six smaller ones is feasible, since the overhead of doing so is much smaller than even the smaller entity size. Setting the threshold such that a company the size of Google would have to split their operations into thousands of individual corporations would be a lot less feasible.

You could also avoid the issue by limiting the exemption to corporations not owned in any part by a corporation that wouldn't itself qualify for the exemption, since the point of the exemption is to help real small entities and not subsidiaries of huge publicly traded corporations.

I worked for a company that was structured like that.

Basically I worked for a very small company that was in the same offices as several other similar sized companies. All those companies where on the same network and there was no distinction of who was working for which company. They all just mixed together.

No one really cared who you work for anyway since it was all owned by the same 3 people and it behaved like a single large company. Technically though it was just lots of small companies as far as the Government was concerned.

You could just add a good faith clause that forbids it.

It does have an exemption that works for everybody: don't track your users, and don't keep data you don't need. Problem solved.

Unless you implement data collection in your indie code (as an indie developer) you have no 'extra' work or burden.

The GDPR scales with the size of the data collection, meaning: it doesn't matter how large the staff/company is, it matters if you collect data, and as an indie developer you'd be in an excellent position to quickly scope out anything you don't need. If anything, it's easier to not build collection than build it if you don't need it.

You might need minimal data yourself, but the tools you use (eg Unity) or the way you monetize (AdSense) do data collection.

That's a failure of the tools, not the regulations.

And again, time to swap out third parties that don't/can't/won't comply... and maybe have to roll your own a little bit if you can't find any compliant tools.

(Throwing Unity in there is a pretty pointless strawman, unless you know that there is something in there that DOES collect user data.)

> A common way to monetize that is through ads and in app purchases that turn ads off.

The point of GDPR is to stop this crap where advertisers demand way too much information. As long as you don't collect uniquely identifying information and personal data about the user then you don't fall under GDPR. Serve whatever ads you want, they just won't be tailored and that's fine (it might reduce your ad rates so its no-longer a viable business proposition but that's the point).

Most people that cry foul about GDPR are the ones collecting uniquely identifiable information about their users. Just stop doing that, that's what the law is designed to prevent.

Quite frankly, I'm sick of all the FUD or what-ifs, but it reliably happens in every GDPR thread, so thank you for jumping in and refuting this. There doesn't seem to be actual evidence that people with non-scummy business practices have been fined, or would be - like the hypothetical indie dev.

I suspect the hardest part is actually finding an ad network that is GDPR compliant, and coming to terms with that you can't just embed every shitty tracking and "analytics" framework into your app. As a consumer, this still all seems like a win to me.

Of course the indie dev wouldn't be fined. These regulations are meant to be used selectively. Essentially, you're encouraged to break the law because everyone else on your level is doing the same. Then you just hope you're not the one that's made an example of.

>As a consumer, this still all seems like a win to me.

Of course, because you won't notice that Europeans can't compete. You'll just use the Chinese/American apps instead, because those can afford to compete.

Note that almost anything can form uniquely identifying information, so technically, it's not easy to fully exempt yourself from GDPR.

Not that anyone would care about minor unwitting infractions. So far, enforcement is way on the other side of spectrum, it's hard to get yourself in trouble even when blatantly and purposefully breaking GDPR.

As point of comparison: CCPA only applies to companies if they have either $25 million in revenue or data on 50,000 users (or derive half their revenue from sale of personal information, regardless of size). And to your point about sensitive data, neither CCPA nor GDPR prevent more specialized laws like HIPAA or GLBA.

If you operate a small company, why not be GDPR complaint to begin with? It seems easier to start out complaint, rather than trying to "fix" the issue once you reach a certain size. The upfront cost seems much lower than retrofitting GDPR into your systems.

Unless I'm a lawyer, I wouldn't trust myself to ensure I'm compliant with all laws. Would probably have to hire lawyers/do an audit which if you're just starting out might not have much money for. Money that could be better spent improving your product so you can provide a service and also make money.

Doesn't mean you can't try your best to be compliant, I still think no matter what you wont know for sure until you hire a third party.

How is the upfront cost lower? If you know software development you could make a simple game quickly. You can add ads to it and release it, except that now you need to essentially be a lawyer to know that the ad network usage you have does not violate GDPR in some way.

The point of GDPR is to protect users' privacy. Clearly it is not in line with the goals of GDPR to allow small companies invade privacy anyway, just because they're small. Privacy is privacy.

GDPR compliance for indie developers is a little painful, but completely doable. The core principles are that you collect as little personal data as possible, have an expiration policy for all data, and don't share personal data with 3rd parties that don't themselves abide by GDPR. If you do these three things you should be OK, assuming you don't collect the most sensitive data.

GDPR isn't meant to bully people who make a good-faith effort to deal with customer data responsibly, and GDPR isn't enforced to destroy those who don't comply perfectly. In the US prosecutors will mercilessly enforce the letter of the law for a few unlucky nobodies to set an example for the rest. In the EU it doesn't work like this.

>In the EU it doesn't work like this.

Yep, it's much more selective in the EU. As long as you are in the good graces of those in power everything will be fine. If you aren't...

The level of corruption is fairly low around here, thankyouverymuch.

For indie developers not in the EU but with users in the EU, what's a good way to deal with Article 27's requirements [1]?

[1] https://gdpr-info.eu/art-27-gdpr/

1. Many indie developers will not actually be subject to the GDPR. The GDPR effectively only applies to non-EU controllers if they are actively targeting and expecting EU users, or if they are monitoring/tracking users in the EU.

The canonical reference to when that's the case is the EDPB Guideline 3/2018 on the territorial scope of the GDPR [1]. These guidelines are more narrow than widely perceived, e.g. that regional US news websites started blocking EU visitors is totally silly and unnecessary. Mere accessibility of a service, without offering the service to persons in the EU, does not trigger the GDPR.

2. If the developer does expect to be subject to the GDPR, they can hire a representative. There are many lawyers offering this service. It's not a terribly involved job, but it affects which member state's data protection agency is responsible. E.g. if you think Austrian GDPR interpretations are nuts, go look for someone in Ireland instead.

[1]: https://edpb.europa.eu/our-work-tools/our-documents/guidelin...

How is "this policy probably won't be enforced so don't worry about it" in any way a reasonable approach?

The problem is really that the indie developer doesn't really have any monetisation options other than those which break the law, but in theory it's not overly onerous to pick one that at least claims to be GDPR compliant. They should be able to trust that their suppliers aren't providing them illegal products tbh.

You're forgetting the most legitimate monetization option:

If you make something great, people will pay for it.

That seem like a lot work, go for VC funding and sell to Google, Facebook, Microsoft or Apple in two years.

That's not how it works at all though. The games on the app store that make a lot of money are those that mercilessly try to rip people off. Gacha games are essentially gambling, whereas proper games with a story and gameplay earn very little.

So if you are talking about games I assume you are talking about something like the Steam store? When I look at their top selling list, there are lots of pretty deep games listed.

Reply on news.ycombinator.com