Comment by kstrauser | Hacker News Reader

Comment by kstrauser | Hacker News Reader

Parent Full thread

I'm curious about this, too. I once commented that, say, my hobby website isn't subject to the GDPR because I love, work, and play in the US and that's where my blog is, too. Turns out some people have very strong opinions about this and insisted that I am subject to the GDPR. But as a practical matter, how? I don't have a presence outside the US. Even if I violated a EU law, is there a reason I'd ever need to care? For instance, I know I've violated some Chinese laws by criticizing their government, but I'm OK with that because, really, what are they going to do about it?

As an aside, I'm completely behind GDPR, CCPA, and related privacy laws. I think they're great. I definitely comply with the spirit of the laws in my hobby projects by doing things like not tracking anonymous users, not retaining identifiable logs, etc. This isn't me trying to get away with something nefarious. More like, I don't (and won't) bother with things like cookie banners even if GDPR would want me to.

GDPR doesn't actually require cookie banners. If all the tracking and data protection you do is justified, justifiable and obviously necessary for the lowest-common-denominator service you provide, you don't even need to ask for consent (though do let your users know what's up, anyway, with at minimum a Privacy Notice in the footer, because that's just common decency).

If a company asks for GDPR consent, either:

• They have cool, optional features of their site / service / system (though they could just ask at run-time, when you try to use those features, in most cases); or

• They're doing something dodgy and want to wave a magic wand and remove the dodginess by getting you to “consent”.

If you're not doing business in or with any EU entities there's not much they can do

Worst case they could block your site, but that's not going to happen.

Note that if it is a personal website you are not subject to GDPR. GDPR only applies to companies and organizations.

Also note that most stuff that a layperson would say is reasonable for a website to function isn't a problem in GDPR.

> most stuff that a layperson would say is reasonable for a website to function isn't a problem in GDPR.

Except revenue of course.

You can advertise perfectly fine, just not track users to show personalized ads.

These were the norm in advertising until like 2005.

Reply on news.ycombinator.com