Which is pretty dumb because the law doesn't apply to them as they are US-exclusive.
> If your organization uses web tools that allow you to track cookies or the IP addresses of people who visit your website from EU countries, then you fall under the scope of the GDPR. Practically speaking, it’s unclear how strictly this provision will be interpreted or how brazenly it will be enforced. Suppose you run a golf course in Manitoba focused exclusively on your local area, but sometimes people in France stumble across your site. Would you find yourself in the crosshairs of European regulators? It’s not likely. But technically you could be held accountable for tracking these data.
So, I've always wondered what they would do? yell at you harshly ?
But I also understand why US companies are doing this. It's kinda like when my dad got parking and speeding tickets sent home from a foreign country. Most likely nothing would happen if he didn't pay them, but you never know when you want to go back to holiday in $country, and the border agent sees them in your "permanent record".
It's at least imaginable that the EU _could_ do something similar, ask for a fine and if not dealt with, the company (or even worse directors of the company) getting some kind of dent in the proverbial permanent record.
(I'm not saying that it's likely, but if EU visitors aren't a big user base for your local regional news paper, I see why it's so tempting to just check the "Block EU visitors" checkbox.)
Downvoters (not necessarily you): This question is why I made sure to quote the paragraph, rather than just link it. "It does" is the lawmakers intent, regardless of feasibility in enforcing it. Avoiding the question entirely is why various sites have decided to block EU access.
No, it does not, anymore than Iran or China get to dictate rules, and for the same reason: the EU has no jurisdiction and no leverage. The EU of course is free to setup their own Great Firewall and block off anyone they dislike, and for people or businesses with assets under their jurisdiction they have an angle to go after that way. But a person or business entirely out of their territory is completely free to flip them the proverbial (or not so proverbial) bird. That is the fundamental nature of "law".
I'll add it's curious this seems to come up on HN with regards to the GDPR so regularly too, precisely because of my first sentence here. It speaks to a real lack of foundation in understanding the basics of law. Are people writing this actually thinking through the implications of every country being able to unilaterally dictate practice worldwide? Or do they think only the EU has this power?
But even if a company doesn't operate in the EU today, it may want to in the future. Or it may want to be acquired by a company that does. The future is unknowable, so I'd imagine they were advised to follow the law, even if there would be no immediate consequences to breaking it.
No, it doesn't, as you yourself admit two sentences later when you write:
>You're pointing out that they may not be able to enforce the law against an entity that does not operate in the EU.
Yes, which by definition means the law does not apply to that person to entity. That is the fundamental nature of law and sovereignty.
>The law itself says so.
Completely irrelevant, in the same way it's irrelevant if you or I order some societal change on our say so. Law is about power. And again, also in the exact same way that it's completely irrelevant if Pakistan or whomever have blasphemy laws on the books they say apply to everyone, China laws against "disrupting society" or someone sues a US entity under the UK's very plaintiff friendly libel laws. They can all be told to pound sand.
>But even if a company doesn't operate in the EU today, it may want to in the future. Or it may want to be acquired by a company that does. The future is unknowable, so I'd imagine they were advised to follow the law, even if there would be no immediate consequences to breaking it.
Sure, but that doesn't mean the law "applies". A company can voluntarily take whatever actions it wishes that it believes may benefit it in the future, but a core point of law is that it's INvoluntary. Since the GDPR doesn't apply to anyone outside of EU jurisdiction (or under treaties giving it local effect), they may choose to run it because they think it's a good idea, or not. Those within EU jurisdiction do not get that choice.
They claim that any company that has dealings with an EU citizen has to follow their laws. Of course they can’t do that. They could have passed a law forbidding their citizens from interacting with businesses that didn’t follow certain rules, since they have the ability to make rules for their citizens, but for some odd reason they decided not to.
Yes, they can.
So can (and does!) the US.
Either may have trouble enforcing them in some cases, but that’s true even of laws within their own territorial domain.
No, the whole point of sovereignty is that if you have it, you are ultimately the arbiter of your laws, including the bounds of where they apply.
You may have practical problems getting your hands on people to apply them, of course, but that’s a separate issue.