Hacker News Reader

Comment by eatonphil | Hacker News Reader

Genuine question: what does this mean for, say, my blog that has Google Analytics on it. I'm in the US. Is my blog violating Austrian law and I'm at legal risk (sure, probably not serious risk) because of it?

Also, what's stopping GA from just showing the consent form automatically? Why haven't they done that already or made it an option?

View on HN

It means nothing for you. There is no legal risk whatsoever. Not in the US, and neither in Europe or Austria if you were to travel there.

For GDPR to apply, your website needs some connection to an EU country beyond just being on the internet. What constitutes such a connection isn't an exact science, obviously, which leads and/or allows people to make rather strange claims, the worst of which is probably that such ambiguity makes it entirely impossible to make laws on the subject.

The "official example" is explicitly making accommodations to sell to customers in the EU. The marginal example on the non-GDPR side of the dividing line is a US website, in English, that does sell to EU customers, but only if they sneak their country into the generic second line of the address form.

What gets you to the other side of the line is, for example, a drop-down that lets you chose an EU country for delivery, a switch that allows users to chose to read your website in German (but not Portuguese b/c Brasil), etc.

While there are plenty of cases, as always in life, that straddle the border, one thing is and always was clear: your English-language blog does not fall under GDPR.

Yeah, this is exactly correct and in line with the legal advice I received when working with GDPR-related features at a previous job. The relevant text is Article 3 of the GDPR ("Territorial Scope"), and if you're not located in the EU and not clearly intending to offer goods and services to EU data subjects, then you're in the clear.

But then isn't Google violating GDPR? Because they do provide goods and services to the EU. Or is the US Google a different company than the one that provides goods in the EU?

In this particular case, Google is considered the "data processor" (as opposed to GP's blog, which is the "data controller"). Google is certainly subject to the GDPR as a data processor in this case. That being said, the EDBP is clear in their guidelines that using a data processor established in the EU does not itself make the controller subject to the GDPR.

My understanding was you had to either not allow connections from that country to access your site or have some version that doesn’t track them.

Your probably not at risk for anything, as your using googles service, but I’m not a lawyer. I’d assume if your using google analytics, google would be responsible for following these guidelines?

Google will probably release info on this if they haven’t already. But I find it hard to believe unless your rolling your own analytics anyone would come after you.

> I’d assume if your using google analytics, google would be responsible for following these guidelines?

IANAL but I doubt that's the case. If GA is being used through your site, you're the data controller and Google are the data processor. [0] At the very least, you're liable as you're the one sending the user's data to GA. This probably holds true even if technically it's the user's own browser making the calls to GA directly, since it was only doing so because your site instructed.

Happy to be corrected if that's not the case.

[0] https://www.gdpreu.org/the-regulation/key-concepts/data-cont...

The GP's blog (the "data controller" in GDPR parlance) isn't an EU entity and it's not clearly intending to offer goods or services to EU data subjects. The blog therefore isn't subject to the GDPR.

If a country wants to do this why don’t they just block connections to all foreign IP ranges and be done with it; don’t make it the rest of the worlds problem.

It says Austrian business in the article. You aren't in their jurisdiction.

> or your website services Austrian citizens

I'm sure I get Austrian traffic from time to time.

you're not servicing anyone, you're not a business

I just made sure you do get traffic from Austria – there, you have it. :-)

On the more serious side, I guess, the outcome may be that GA will be not allowed to collect certain data in Austria. (Just a personal opinion, not a legal advice.)

Mind that you can add `ga('set', 'anonymizeIp', true);` to any GA embedding script, which should be more in compliance. (My guess is that GA will have to default to this mode anyway.)

Edit: GDPR is about storing and processing personalized data. Meaning, if no personalized data is involved, there shouldn't be any need for even declaring it, nor should it be subject to explicit opt-in. On the other hand, we can't be sure, if `ga('set', 'anonymizeIp', true);` really does what it says. (Again, not a legal advice.)

Their anonymize IP feature is basically useless unfortunately. It can only anonymize the IP address in a visitor's browser, Google will still get the real IP address from the HTTP request.

This feature doesn't do anything for GDPR compliance and almost certainly wouldn't hold up in court, if it ever came to that for a particular site.

Yes, it's basically just like the do-not-track feature: we can only declare our intend, but we cannot be sure, whether or not this will be honoured on the server side of things. It would be up to Google to provide some kind of proof of legal relevance.

Why do so many US sites block my EU IP address, citing GDPR?

Their owner generally also owns an advertising business or similar and wants to make a point.

because they'd rather block the EU than figure out if the GDPR has any implications for them, it's pure laziness

It's also a cost. To be compliant, there's a bunch of mandatory expenses you have. It's not as simple as "just figure out the GDPR". Heck, just doing that is paying some lawyer $400-500/hr. And because it's the USA, GDPR compliance lawyers aren't around every corner. So you're probably paying extra above that.

there are no mandatory expenses, and you can indeed figure it out yourself… especially if you’re not selling things to europeans or handling personal data

Wow. You really have no idea how it works. This is a case about an IP address. The most basic thing that gets logged by most websites. You should honestly go out and hire an attorney to teach you about GDPR. Let us know what the legal bill is.

This is why most US companies chose to just block the EU entirely. No need to deal with it or bad advice like what you're sharing here.

You're just drumming up the same scary nonsense, there's some weird fetish people seem to have where they show up to comment threads like this and say "OoOoOh but you don't really know".

It's possible. I deal with European customers, their lawyers have signed off on my implementation.

Lawyers signed off on sites using Google Analytics. Oops. Turns out that was a mistake.

When GDPR came out, we had a serious discussion about whether Europe having access to our site was important enough to implement GDPR, or if we should just block Europe all together. In the end we decided to bite the bullet and implement it, but it could easily have gone either way.

Presumably because the fines for getting GDPR wrong are potentially very high, where "less severe infringements could result in a fine of up to €10 million" and more serious infringements "could result in a fine of up to €20 million,". [0]

Personally I'm afraid to make anything I'm working on publicly available, in case the server logging at some level isn't compliant. It's hard to be sure something hasn't been overlooked, and the monetary risk is very high.

[0] https://gdpr.eu/fines/

> It's hard to be sure something hasn't been overlooked.

It's not that hard, unless you're using squillions of third-party services. And that's the kind of thing that GDPR is meant to discourage.

It is that hard. The level of certainty you need when "less serious" fines have 8 digits is hard even if you're just running HTTP "Hello World" on port 80 on the internet. The risk of a mistake in your configuration logging PII that you misplace and forget about is too high.

Note that stuff like basic request logging is likely to¹ fall under “legitimate interest”: you can keep that data, so long as you only use it for diagnostics, debugging and basic analytics (e.g., no selling your server logs to Facebook). You aren't going to get in trouble for your basic Hello World.

And even if it didn't, the only PII that that would gather is IP addresses (and user agents, but I don't know that those count). It's relatively easy to hit your service from a local IP address with a custom User Agent, then check for that IP address and user agent in all the files on the machine. (Log files are pretty much all plain-text, but you could look for the two obvious byte encodings of the IP address too, if you like. Maybe also check the contents of gz files, but that's starting to get silly.)

¹: Read: I'm basically certain, but I'm not a lawyer and my understanding of the “legitimate interest” basis is not as good as my understanding of the rest of GDPR.

With the potential for a 10 million euro fine, I don't think "basically certain" is sufficient.

It's only/mostly small-town newspapers that do this. It's an ideological statement that's cheap for them to make because The Buttherd Dispatch doesn't have enough readers in the EU for it to matter financially.

Because they have the choice of letting you choose what happens with your personal data (if you live in the EU) or not doing business there at all.

In other words, if there's even a chance that you say no to them (ab)using your data any which way they like, they consider you a net negative to their business.

Because GDPR is too difficult to comply with. It's overbroad (covers far too many situations).

If you serve pages to EU citizens then you run the risk of breaking the law in Austria. If the Austrian Data Protection Authority (DSB[0]) were to take you to court (in Austria) then you (or your company) may be prosecuted. So the question then is would the DSB attempt prosecution? If they did and you don't offer a defence then you would probably lose by default. The question then would be are you judgement proof?[1]

"The extraterritorial reach of the GDPR is broadly defined. It applies to a controller or processor of data when they are monitoring the behavior of data subjects within the EU, when they are processing data related to the offering of goods or services to data subjects in the EU, or when they have an establishment in the EU and the processing of data is happening in the context of that EU establishment." [2]

This is not legal advice, etc.

[0] https://www.data-protection-authority.gv.at/ [1] https://en.wikipedia.org/wiki/Judgment_proof [2] https://www.clarip.com/data-privacy/gdpr-united-states/

For further guidance the best source is probably the European Data Protection Board's (EDPB) own guidance for the territorial scope of the GDPR.[0]

[0] https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_gui...

And people were making fun of American businesses for just geoblocking the EU.

Reply on news.ycombinator.com