Hacker News Reader

Well, this reminded me of the situation right here in the US. The other day I couldn't place an online order at CVS because it was repeatedly "having technical difficulties". Turns out I had to unblock half a dozen (!) advertising domains in my Pihole (incl. the ones I've never heard of) to finally place an order. I don't know how to treat it as "I have a choice whether to do business with them" ;-)

I guess the only way to protect my privacy in this case is to risk going to the physical store with other sick people atm.

> I guess the only way to protect my privacy in this case is to risk going to the physical store

Never give them your phone number. They suckered me, and it took multiple calls to a very slow call center to get the text messages to stop. And I couldn't get them to just delete it - it had to be done as a number change. So my number is now 415.555.1212.

> Never give them your phone number.

Give them Jenny's number:

(your local area code) 867-5309

It works way more often than you'd think, and if no one has yet made a store loyalty account with the number, you can be the first and add to the movement :). Use this trick whenever you need a loyalty card to get a store discount.

All jokes aside, this would obviously divulge order details and/or control to whomever owns that number :-) Easier to just block the damn number.

The use case I'm thinking of is when buying random sundries at the store, not ordering sensitive items.

Ah makes sense then! And would be pretty fun.

I've just compulsively been doing it any time I get anything from a store with a loyalty card, which is all of them now, and not once out of a dozen different local stores did I need to create the account--someone always already had :). This I think is a great way to protest against retail surveillance.

Oh don't get me started on that! I already gave, and regretted it ever since. There's no way to stop those messages now.

I even called them and they stopped for a while, and are now back in full force, right after my recent order.

Incidentally, I've even discovered what seems to be one of (probably many) security issues on it (one where you could see other person's order details without authentication, in this case for myself), but I'm not gonna report it because they likely don't even have a bounty program and it was likely a "feature" implemented intentionally.

I handle this pragmatically by using different VMs with assorted browsers, browser configs, and exit addresses. For the context of buying from CVS (realworld nym, heavy surveillance), I'm running NoScript and slowly enable domains until the site works. Doing this for some sites actually speeds them up considerably (eg Home Depot).

The problem is in this case, no amount of blocking will work, because the site was completely broken without those, at least for me :-) Though I can reduce the amount of divulged info for sure, but the very fact they're using them means my order details likely go to third-parties, and it's impossible to prevent that because it relies on that reporting in the chain of logic (i.e. order won't proceed until a successful response from the advertising APIs).

The only technical way around that I can think of is to implement Signal's and other's API proxies and let it return back fake info to the site. But I'm not that obsessed about this issue :-)

Another over-the-top way is to place the order directly against CVS APIs, using their cookies etc. Again, not worth spending time on..

Why not just avoid CVS and use another pharmacy (online ordering). I use valisure because they also test the medications they sell for impurities, but there are plenty of others… like even supermarket pharmacies have online ordering now with home delivery or pickup.

Some medical insurances require using CVS. One might be surprised by how shitty that is, but if so one has forgotten how shitty it is to live in a jurisdiction where medical insurance is a thing that is necessary.

If a non-EU site finds itself subject to GDPR because of Article 3(2), they need to then worry about whether or not Article 27(2) applies to excuse them from Article 27(1). If not then they have to deal with the hassle and expense of hiring a representative in the Union.

If they are indifferent to EU visitors but happen to get enough of them that 27(2) won't excuse them from 27(1), then it may be worth blocking EU visitors to try to reduce the chances that 3(2) applies. Article 3(2) is somewhat objecting, relying on whether you intended or not to offer goods or services to people in the Union so blocking is a way to make your intent clear.

IP addresses are considered to be personal data under GDPR, so a site that is doing nothing other than serving content with no advertising or targeting but that has the default Apache logging enabled could end up with an Article 27 obligation.

Just reading this comment makes me inclined to block visitors from the EU from my hobby sites. (Work is compliant; hobby/personal stuff isn’t worth the bother of even reading what Article 3(2) is.)

Article 3(2) is short. Here it is:

> 2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

> (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

> (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

Recital 23 includes an elaboration on (a):

> In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.

Probably nothing to worry about for a hobby site.

I feel the same, and I live in the EU.

The silver lining of my aversion to collecting user data is that it aligns nicely with my beliefs about privacy and minimalism (ie. coming up with ideas for web applications that don't even need a backend).

Rule #437: don’t take legal advice from random internet dudes.

GDPR has been out for some years now and we can see the enforcement personnel do not go after companies worth under $100 million, let alone hobby sites. After all, enforcement personnel only have so much capacity.l just like the FDA, USDA, BLM, and countless other agencies burdened with enforcement.

> perhaps have to think rather carefully about if you wish to do business with them

This seems to be precisely what happened--and the thinking involved invention--a way of circumventing what prevented acquiring the needed medication. (I assume that alternatives were considered, and found wanting for one reason or another).

To be fair, both of the sites he mentioned are Indian (netmeds.com and makemytrip.com)

I’m sure there are sites in the US, however, that block access from GDPR countries.

Business and people will take the path of least resistance.

If only a small part of my traffic / business comes from the EU yet I am going to incur huge costs, and have to fundamentally change the way my business runs to comply with GDPR guess what, the EU is getting blocked, as make not sense to do it.

My current company does not really collect user info, does no business at all in the EU or is even consumer facing in the US but looking at our internal processes it would be almost impossible to comply with GDPR with out changing MASSIVE amounts of internal processes and procedures.

> Business and people will take the path of least resistance.

No, this is malicious compliance.

And circumventing that block violates the CCFA (at least here in the US) so instead of the GDPR turning me into a criminal, SO users who visit my site are the ones violating the law.

On the other side of this, depending on the breadth of your data, it can be non trivial to run pipelines to redact someones information. It takes man hours to verify, and processing time ($$). Plus, what if they don't have that process in place? They will need to do it manually, and take up more time from someone. Plus you need to communicate with the requestee and verify their identity as well as give them updates when they ask.

This is fine if not abused. But if a mountain of redactions came in, I could see a company just deciding it wasn't worth it to serve the EU. Not to mention the fact that there are a non-zero amount of people that will make GDPR redaction requests and hound the company down in hopes of suing them if they don't follow the law to the letter and/or can't process the redaction in time. If a company doesn't already have that process in place, it could be a momentous task to initially process.

I'm 100% for user privacy. But it can be tricky with the way the GDPR law works, so I understand why companies outside of the EU don't bother with it.

I think in CVS's case likely yes, they probably hired underpaid folks to implement their site, and now those folks are probably long gone so no one would even know how to remove all those advertising domains without which the site doesn't work.

There are two easy answers for this:

1. Don't create surveillance files on people in the first place. It's not like the lack of privacy legislation means there are legitimate reasons to be performing surveillance. It's just that the illegitimate ones have not yet been made illegal.

2. US states should start adopting the GDPR verbatim (with no corpocratic handouts), so there is only one law to follow.

Is there a study on comparing number of people actually selecting cookies on the pop ups vs. number of users who already had Adblock? Because unless you have that info, GDPR cannot be claimed to protect any privacy. How many people who never had Adblock are selecting which cookies they want on these pop ups?

And it’s not only the US websites, the website OP mentioned is one of the three largest medicine websites in India. There is no reason for them to comply. And EU laws are incredibly confusing. Follow GDPR and respect privacy, while saving customer IP address for years when EU needs VAT.