Hacker News Reader

You and your business are crossing borders when you serve traffic to foreign customers, and are thus party to their laws.

No I'm not a lawyer, but if you really never intend to have any customers in Europe you'll probably be fine (ask a lawyer, not the Internet) but if you do or might then you're playing a game with whether or not you'll be caught or if the consequences will be more advantageous than mitigating them.

America projects it's laws worldwide with the global financial system and anything with even a remote connection to the states is a poison pill that is used to prosecute behavior which is almost exclusively outside its borders. Other legal entities can do the same, but to a lesser extent.

> You and your business are crossing borders when you serve traffic

I’d argue that if the request originates outside my country, the customer has crossed the border with the intent to bring the content back to their country

I'd definitely put the onus on them. It's pretty insane that even routing and logs will cause issues because of a law on their side.

I agree there, but also there is the perspective that the consumer of the content did not ask your server to take their data for analytics purposes. So it goes both ways

I understand that, but even without analytics, it wouldn't conform simply because it's hosted in the US and the IP can be stored there.

The way routing works, you can't prevent the IP from going to the US if it's just hosted there.

AFAIK the IP from requests doesn't necessarily need to be logged or stored anywhere, does it? Perhaps this comes from my lack of understanding of GDPR but I thought the issue was from storage where it could be retrieved or shared

The problem is that the US CLOUD act compels US companies to provide data access to US agencies, regardless of where the data flows. It could even be servers on EU soil. EU courts hold that these kind of acts violate the data rights of individuals located in the EU.

well, it seems that the EU has already decided that is not going to be the interpretation they will accept so argue away.

There are also thousands of different analogies like yours that one might choose that would put the benefit on the EU side, for example, someone might argue your website is like a product and as such is open to all sorts of regulations and taxes when it gets 'imported'.

The result of this argument is that every company can easily make themselves immune to all laws and regulation by setting up shells across borders.

As long as they don't register users, accept payments, etc - just serve content - I'm okay with this interpretation.

And if they, keep records of unregistered users, track their behavior, and sell that data or use it to make business decisions?

As long as they do it on their site, not third-party ones or via third-party ones, then also ok.

I'm not sure GDPR applies if they're not using any third party services. That's the thing with GDPR compliance, if you're already doing things right it doesn't really change anything, you don't even need to ask about cookies (because cookies are actually ok under GDPR if they're used the way they were originally intended.)

Sounds good to me; I'd like to take advantage of something like that one of these days.

It's not actually about serving traffic across borders, it's about what you collect. If you collect PII, according to EU courts, you are responsible for it and will be held responsible if you plan to do business in the EU.

> I don't mean to be confrontational, but as an American with websites in the US- why would I care?

What about all the users on HN who have websites and who happen to be from the EU though?

It's not because you don't care that no-one here cares.

Sure, but while you're post comes across as the American being dismissive of others, you're post also comes across as dismissive of a valid question from the American. Let me rephrase:

If I as an American build a retail site for a side hustle that I have no intention of doing international business, do I still need to concern myself with international rules? It's "easy enough" to not allow sales to international locations, but not allowing the website to be viewed internationally is just too much damn work and goes above and beyond sane expectations.

IANAL so I honestly can't answer that, and I can totally understand some US sites blocking EU IP ranges because of their business model as an ad outlet for Google or whatever third-party ads.

But even if you don't agree with EU privacy regulations, I hope you can understand that the race to the bottom we've seen in the last decade or so when it comes to online content must somehow be stopped, especially if it is only benefitting very few quasi-monopolies.

My hope would be that we could see a return to direct sponsoring or other first-party ad model, but perhaps I'm being naive here, and I'd appreciate insights from others. Personally, I don't have a problem with ads per se at all, provided they're respecting my privacy and don't come in the form of a JavaScript bomb.

The law applies to websites, not businesses. If your website has European visitors, then it is making the relevant interaction even without business happening. I’ve come across websites that simply deny me access, guaranteeing they don’t have any European visitors. US law spreads in a few ways, eg licence to use the dollar, though that may be broader than the exact wording.

I would love to see this fought in court for my local neighborhood restaurant. No way would a US court hold that GDPR has any standing.

I'm sure they wouldn't, as it's not a US law. But a local company may be small enough not to have to bother, just as they don't have to provide certain US law based employer benefits.

> The second exception is for organizations with fewer than 250 employees. Small- and medium-sized enterprises (SMEs) are not totally exempt from the GDPR, but the regulation does free them from record-keeping obligations in most cases (see Article 30.5).

I’d add to that Lawyers, Engineers, Financial Advisors, and many other roles that are licensed by territory. Regardless of what the GDPR says.

I don't actually see any way that your local neighborhood restaurant, assuming your local neighborhood is not in the EU, will in any way be covered by the GDPR.

It will for the first be too small to require much record keeping.

Second, it is unlikely to be keeping any personally identifying information from someone using the site while in the EU because nobody is ordering food from a pizza place in NYC while sitting in Napoli. IP address is sometimes PII but more often not.

Thirdly, as your local restaurant does not have any business operations in the EU any potential fines levied against them would probably be unenforceable.

Those are just the top three things that spring to my mind though, pretty sure that there are other reasons the worry is nonsensical.

OP's site seems to focus on where servers are hosted, not about how or what data is stored or whether or not violations are enforceable.

A European could order delivery in the USA for a friend. The business (website) would happily accept money for this.

theoretically this situation could arise, in practice c'mon. I have friends in the U.S but I'm not ordering any delivery for them unless I'm there.

A friend did that with flowers for my wife's birthday during 1st year of Covid (although the person was from the UK, not the EU proper).

Every time I have ever bought flowers internationally it has been through some big international floral delivery company that handles the actual contact to the local florist, hence I do not believe that any of the florists that actually delivered the flowers to their recipient was in possession of any personal information.

Thus a small florist does not operate the same way as a small local restaurant, the big international company with my personal information however will be on the hook for it and should have processes in place to handle that.

Managers in the EU could order food for their team in SF for a "lunch and learn."

I don't think this is that crazy of an example in this world.

Ok, well in that case if they did that and the restaurant decided to save the personal data longer than was necessary to fulfill their legitimate business purposes then I guess they would be under GDPR. Legitimate business purposes might be (just guessing as I am not a restaurateur)- IP addresses kept for a week until profile of website visitors report for that week made, credit card and name kept until payment received.

It doesn't matter whether you are there or not. If you are an EU citizen, and you're in the US, and you visit a US website and make an order from that website, that website is now supposedly required to obey EU law.

you are however incorrect

https://www.hipaajournal.com/does-gdpr-apply-to-eu-citizens-...

"GDPR requires the personal data of an individual residing in an EU country to be subject to certain safeguards and their data rights and freedoms must be protected. When an individual leaves an EU country and travels to a non-EU country, they are no longer protected by GDPR."

It was quite a common misconception when GDPR was first being formalized that it would apply to EU citizens physically located outside of the EU, indeed if you go back about 6 years you would probably find me making the same incorrect argument on HN.

I'm open to being corrected. However, this article is about people who are living in, not visiting another country.

the linked article specifically says

"When an individual leaves an EU country and travels to a non-EU country, they are no longer protected by GDPR."

and

"If an EU citizen travelled to the United States and interacted with an EU business, which required the collection of their personal data, their data rights and freedoms would be dictated by US federal and state laws. GDPR would not apply."

true, this is inside a section where the headline refers to people 'living' in the US (which of course implies taking up a long term residence there), but the text of the body makes clear that just traveling to the US means that, as one would normally expect, the laws of the US pertain and not the laws of the EU.

Thanks. TIL. What an absurd law.

It makes zero sense to suddenly say that it matters where the company is if the EU citizen isn't in the EU anymore, but it doesn't matter where the company is if the EU citizen is in the EU.

Either the EU can make a law apply to my website, or it can't. If it can, why does it not do it all the time? If it can't why does it claim it does?

I'm personally of the opinion that they can't, and I'm going to keep acting accordingly.

And I'm willing to bet so are the vast majority of other websites. If anybody sees a drastic drop in Google Fonts usage, let me know. Otherwise I'll just keep saying, "I told you so." Nobody actually believes the EU can do this.

Not to be repetitive, but- let's say your website has visitors from Thailand, and you do something to defame their monarch. Are you in compliance with Thai law? What if you have Chinese visitors, are you subject to Chinese law? What if the Central African Republic passes some completely out-there law and you have CAE visitors- do you feel like you need to comply with the laws of the Central African Republic? If not, why not?

Let's just think this out- seeing as your visitors can come from any of the 300+ countries on Earth, you are saying that by hosting a website, you must simultaneously comply with the Internet laws of every country on the planet. Please just consider how ridiculous that is for a moment

If you speak in your country and someone hears it where it's illegal then that's of no interest to you. But if you visit someone's home and they add your name to their guestbook you may care that you're in the records. Yes, it's reaching beyond borders, but I like this one more than any of the other examples of that.

I could repetitively make up new analogies to explain my opinion (and subsequent actions in democracy), but after a moment's consideration that would be ridiculous.

Explained here [Who does the data protection law apply to?](https://ec.europa.eu/info/law/law-topic/data-protection/refo...)

Even if you don't think GDPR compliance is important, you probably need to consider the California Consumer Privacy Act and California Privacy Rights Act, if you are running a business that's big enough to be subject to them. These laws are broadly similar to GDPR.

Yeah, the GDPR is basically irrelevant to Americans unless you're a multinational corporation. But unless you're a VERY local business, you will want to take the CCPA into account, because California will be very happy to fine a business located in other states.

CCPA is a little more reasonable than the GDPR, but if you're abiding by the CCPA you're probably good enough.

The GDPR explicitly only affects businesses selling to Europeans¹, so you're correct: you don't have to care about it.

¹GDPR Article 3, section 2a. A broad reading would assume that any use of a site by Europeans is also covered (section 2b), but IIRC the various data protection authorities issued guidance that you're fine so long as your material isn't aimed at Europeans: e.g., no European pricing, etc.. https://gdpr-info.eu/art-3-gdpr/

You are absolutely right. Unfortunately, the European lawmakers doesn't understand how international law works, so they created a "worldwide" law without any possibility to enforce that law outside of the EU. For that reason some people call GDPR a paper tiger.

They fully understand what international law is.

You could say that US lawmakers don't understand international laws because US data laws are extraterritorial.