Hacker News Reader

Comment by jaclaz | Hacker News Reader

Thanks.

Only for the record, the message I get from EU:

451: Unavailable due to legal reasons

We recognize you are attempting to access this website from a country belonging to the European Economic Area (EEA) including the EU which enforces the General Data Protection Regulation (GDPR) and therefore access cannot be granted at this time. For any issues, contact help@purdueexponent.org or call 765-743-1111.

Maybe it is just me, but the "therefore" is not consequential.

AFAIK, if you don't gather data, you don't have to protect them, GDPR or not.

View on HN

We detached this subthread from https://news.ycombinator.com/item?id=29591781.

I did that so the latter could be pinned to the top of the thread without being offtopic.

Can't help seeing the irony that the censored document is a declaration by the publisher about how strongly they are committed to freedom of expression in international context..

CORRECTION: As other have pointed out, the publisher is actually the student newspaper, which is independent from Purdue University itself.

The letter is from the president of Purdue, while the web site is a news site that is independent of the university.

Also, it’s not really censorship — they have to deal with the GDPR headache, one way or the other, just like everyone else. Simply blocking the EU is a blunt but simple and effective way of doing so, and makes decent sense for a site where the interest is 99% local.

> they have to deal with the GDPR headache

What headache? A sensible solution: when EU visitor is detected, don't set cookies. Purdue solution: when EU visitor is detected, block them.

> What headache? A sensible solution: when EU visitor is detected, don't set cookies.

The headache is convincing someone to pay a lawyer to agree that this is the solution when serving content to the EU is outside your publication's mission.

Also: The Exponent isn't Purdue, it's independent. Purdue chose email as their publication medium.

The GDPR is about personal data. It can get complex when you actually start to deal with personal data. You need to notify users, enable them to modify their data and so on. For many platforms this is already very easy or built in, for some like ERP systems it was quite complicated.

Fortunately there exist a very simple solution: don't gather personal data. Note that it does not necessarily applies to cookies: they are considered personal data only if they can be used to identify the individual.[0] There is exactly zero chance anybody would go after you if you don't set cookies or set them for reasons other than making personal identification possible.

[0] https://www.itgovernance.eu/blog/en/how-the-gdpr-affects-coo...

Not sure if that is enough. They seem to have facebook and twitter links and as far as I remember these usually come in a JavaScript spyware bundle and those are only the obvious ones.

>when EU visitor is detected, don't set cookies

How do you know that somewhere in the stack of things the server is running isn't something that would set a cookie for some valid reason, and thus trigger the EU's stupid laws?

A positive stop, the redirect to a text page, is far better than a hope and a prayer.

Not setting cookies is a radical solution. Actually there is no problem with cookies at all unless they are being used to identify the individual. [0] So by definition any valid reason causes absolutely no problem. It is only if you decide that you want to deal with personally identifiable information, transfer it to third parties etc., it becomes problematic. People in the EU quickly learned not to do that and we're very happy about it.

[0] https://www.itgovernance.eu/blog/en/how-the-gdpr-affects-coo...

Dealing with the GDPR costs money. Blocking the entire EU is free.

This started happening even before the GDPR was finalised.

>Can't help seeing the irony that the censored document is a declaration by the publisher about how strongly they are committed to freedom of expression in international context..

Yep, and - also ironically - the root of publisher is the same as public, so you want to make something public but you restrict the access to a whole subset of the public.

Besides that, if they had written (without recurring to http 451[0]) a simple message like:

"We are sorry but we cannot serve this content due to the possible non-compliance of this site with EU Laws (GDPR)"

it would have been (IMHO) much more correct/polite.

I read the message "as is" more like:

Hallo, stupid visitor from Europe, you are denied access to the contents because you voted stupid people that wrote stupid laws that we won't respect.

The page served should be reachable even from non EU countries:

https://www.purdueexponent.org/campus/article_aa3e67de-5de9-...

and it has some interesting html keywords in "base":

[0] the example on Wikipedia is a good one:

https://en.wikipedia.org/wiki/HTTP_451

Also, they don't have the money to comply with the EU's GDPR from a legal requirement, so this is really a result of the EU's laws.

If you don't collect data on the visitors you don't need to do anything to comply.

…on a page that makes a call to Google Tag Manager.

My guess is that there is not enough staff resources to ensure that all sites are compliant to the GDPR regulations so a blanket block of the EU was the most (only) cost effective solution to mitigate risk.

If they don't have user accounts and no ads then there's literally nothing to do to be GDPR compliant. Literally zero.

You need to NOT store IP addresses. And the hosters that provide you traffic need to also NOT store them

You're kidding, right? I was hoping after so many years it's clear. GDPR is about personal information. First, if you have no way of linking the IP to personal information, it does not apply. Second, even if it's linked (as in a web store etc.), storing it is perfectly fine! You just need to clearly state what information you store and for how long.

Everybody, also in the EU, are storing IP addresses. Everybody. Even the company who bragged they don't store logs for privacy reasons was caught storing them. It is important, it is necessary, and in many cases required by law.

Why risk getting entangled in weird foreign laws that might still have consequences here? The simplest solution is the best, just say no thanks in a simple redirect.

I understand why some people might be afraid of the risk. My point is that since you already implemented the code to detect EU customers, you could as well decide to not to set cookies rather than block them. In terms of complexity it's basically the same, but you get the benefit of increased exposure.

This website is an independent publication about Purdue, not Purdue itself.

If you're small and running ads, I'm pretty sure you don't want to risk dealing with the significant legal pitfalls of GDPR. They EU isn't your audience, and lawyers that confirm you're in compliance (or not) are expensive.

> They EU isn't your audience, and lawyers that confirm you're in compliance (or not) are expensive.

The GDPR is one of the easiest pieces of legislation I've ever read. And the answer is: no, basically nobody is in compliance.

Everybody who doesn't collect personal data about their visitors is perfectly compliant.

Indeed.

That's a bit of an exaggeration. Those that try to collect as much data as possible data from visitors will of course find it difficult to be compliant, but many do not do this and are therefore in compliance with GDPR.

I do find the propaganda against GDPR annoying though. As an EU citizen (and someone who had to make sure we were compliant on multiple projects) I am happy about it. Is it perfect? No. But it's still waaaay better than nothing.

> but many do not do this and are therefore in compliance with GDPR.

Of the parts of the web I frequent? Sure. Most people will never leave the GDPR-violating web most months.

If you're an explicitly US website with no operations abroad, you shouldn't even give the GDPR a second thought. And if that's the case and you also have no operations in California, you should give the CCPA the same treatment.

I am not sure about Purdue and their affiliation with their student newspaper, but many US universities have operations abroad to some extent, like a recruiting office or something.

Indeed I interpret this as “they were going to extract much more data than needed”, but it could just be fear.

Based on their privacy policy, it's data extraction. Also for some reason they link out to privacy policies of the Walt Disney company and the Washington Post? They also seem to use some obscure, third party CMS provider, and perhaps the ads are handled by that organization? In either case, I'm not sure why a student run, university newspaper needs to have such predatory data practices.

I saw it as the opposite- the website was exposing personal info about the man who was harassed.

If you are in the US without any foothold in the EU you should not care. I do not understand why these US-only sites care at all about EU.

I am French so I do care very much about privacy, just do not understand these blocks.

People of the EU might want to seriously reconsider the GDPR after seeing its affects such as this.

As an European citizen, yes I am profoundly glad these effects exist. Error 418 means, to me, that the website is disappointed it cannot exploit my personal data without my consent. Good riddance.

Honest question: How do you feel about your (i)phone being a permanent cookie? It aggregates all your information.

Is anything being prepared for that?

Note Gdpr is not only about cookies. It's about data collection. Being able to get and erase your personal data from any website is quite a nice feature.

I contribute monthly to https://noyb.eu/ and am following their initiatives in that regard [1].

[1] https://noyb.eu/en/project/advertising-ids

Quite the opposite! I'd much rather that the website denied me access than treated my private info like their own property purely because they are too lazy to be GDPR compliant.

This could be a client setting, rather than forcing this preference on 400 million users because of where they live.

Yeah, that's not how laws are supposed to work.

I find the use of the 451 status code almost offensive in this case. They're invoking one of the most famous literary treatments of censorship, when really what's happening is that the citizens of the EU are being protected from an assault on our human rights.

"HTTP 451 Not available for legal reasons" is an established convention

I would strongly prefer if my browser handled my privacy preferences and ensured my personal data isn't shared with websites I don't want to share it with.

Because even if a website promises to obey GDPR rules, I have no way to verify if they actually do.

Sites in the rest of the world might want to seriously reconsider their data collection practices after seeing its effects such as this.

As an EU citizen: Actually, no. Now, if only we could get rid of the dark-patterned cookie dialogs..

I'd rather seriously reconsider dealing with publishers of sites who consider it so important to trample all over our privacy rights that they'd rather block access than address the issues.

I occasionally run into websites that deny access rather than complying with the GDPR, but that's fairly rare and happens perhaps a few times a year. Most sites I've seen have gone through the trouble of complying and implementing cookie consent controls instead.

The added legal complexity from the GDPR for small-time operations has made me skeptical at times, but geoblocking due to the GDPR seems surprisingly rare and not a reason for that skepticism at all. I'd frankly have expected it to be much more common than it's turned out to be.

Reply on news.ycombinator.com