Hacker News Reader

Comment by qeternity | Hacker News Reader

As an American living in London, I find GDPR blocks extremely annoying…but I blame GDPR. It is a well intentioned law but horribly scoped. If I were the technical staff at a regional university in the US, I wouldn’t invest in compliance with a law that in theory can issue severe penalties. I would simply block that traffic, as they and many others have done.

View on HN

Compliance is easy : don't add the code that track users and you're compliant.

If you do insist on tracking, make it opt out by default.

You mean opt in by default / opted out by default?

So, I have to disable logging on my servers to comply with your regulations? No thanks.

Are the logs permanent? If not then GDPR doesn't cover it. Can you use the logs to identify users and their behaviour? If not GDPR doesn't cover it.

If you keep permanent logs with information about users, then yeah that is a problem. But it should be a problem, that is a big potential security/privacy issue.

This is a student run newspaper. They probably don’t employ a dedicated IT professional nor a legal professional to help them understand what GDPR requires of them. It’s easy to say “compliance with GDPR is so easy” when you’ve taken the time to understand what it requires—why should an American student newspaper have to take the time to learn other countries’ laws? Blocking access is easier especially considering the probability of the web site appealing to an international audience.

"...why should an American student newspaper have to take the time to learn other countries’ laws?".

Students! Learning! (Continents!).

> Students! Learning! (Continents!).

I’m not sure how I’m supposed to parse this. Maybe the “continents” is meant to be a correction from “countries’ laws”, but that would be a mistake because the EU isn’t a continent but rather a union of sovereign nations, and “countries’” is plural possessive so the original wording is correct.

Also a good lesson for students: avoid trouble when it is easy to do so.

Since GDPR, I've had to implement a lot of data retention policy and "nuke" button type feature in various systems.

But as a general web consumer myself, all I've noticed is that nearly every website I visit has a banner at the bottom saying "We use cookies, click Accept". Very rarely is there some kind of "Please Don't" button. It's just tacit acceptance, or else close the browser tab to opt-out.

Banners without the option to decline unnecessary cookies and still get the content are a GDPR violation.

Or block access and move on with your day.

Reply on news.ycombinator.com