Yes, because GDPR compliance potentially costs a lot to implement, most small town news sites in the US will just block the EU than even try to sort it out.
It's not "we're abusing people so we're banning the people it's illegal to abuse", it's "we don't know if what we're doing falls under the definition of what's considered abuse, and the people it's illegal to abuse are not part of our market, so this is the shortest-path to guaranteeing we don't accidentally do anything illegal".
If it were some very large international website, it could more reasonably considered an admission of guilt, but for a small regional newspaper I don't think it is.
And what's your knowledge of their code stack and backends?
1) They aren't collecting personally identifiable information, and therefore don't fall within the scope of the GDPR, and therefore the cost of compliance is virtually nil
or:
2) They are collecting personally identifiable information. For just visiting their site, that's abuse.
> And what's your knowledge of their code stack and backends?
Not relevant.
For example, when the RIAA was suing everyone for pirating music...it was claimed by the tech community that an IP address is not enough to personally identify someone for a lawsuit. But the GDPR claims that IP addresses are PII. Which is correct? Our choices are live in a world where website operators can't log an IP address, but the RIAA or anybody can use an IP address to target someone for a lawsuit? Or we can live in a world where website operators can log an IP address, but the RIAA can't use an IP address to target someone for a lawsuit.
And your knowledge of their backend is relevant, because you made a claim about its behavior - specifically that it would be easy to stop abuse for everyone. But what if parts of their system rely on, say, a logged IP address to aggregate some statistic that is important for the business folk? It might require reworking a large portion of their backend if they need to derive this non-abusive information in a different manner.
Verify what? That the news are in fact written in English?
...that can be an expensive question to answer if you're trying to be in compliance and don't know what compliance means.
Even an answer of "you need to do nothing" can be pretty expensive.
Whether or not someone has already been fined (even within your constraints) influences the risk decision, but it does not remove the risk. Since there is still risk, it must be weighed against the organization's risk tolerance.
Evidently, the risk still exceeds the risk tolerance of several smaller websites.
Try again.
I take it you have rock falling from the sky insurance as well? And don't forget about the crocodiles.
They say, without refuting anything.
>I take it you have rock falling from the sky insurance as well? And don't forget about the crocodiles.
I have life insurance, yep! Which includes accidents, etc. Not that either of those situations is remotely analogous to GDPR fines.
Edit: I should make it clear that I don't operate the sites, so if your upset about what conclusion these websites came to, take it up with them. I am just pointing out that there still is a risk, and it is obvious that this remaining risk matters to some of these sites as they choose not to serve EU visitors. Do I block EU citizens from my site? No, I don't.
lawyer: so there's this new EU law that could get us in trouble if we keep using google analytics and an EU citizen tries to access our site
manager: do we have to comply?
lawyer: we could, but it would require work. we can also just block visitors from the EU and not have to worry about it at all
manager: ok moving on
* Logs, including firewall logs, web server logs, WAF logs, flow logs, etc. (Remember: Under a number of legal interpretations of GDPR, an IP address is a unique identifier.)
* Any comment sections, feedback forms, contact forms, etc.
* WAF, Anti-Bot, DDoS protection.
* Any third party vendors used in serving the site, and the specific integrations.
* Advertisements, which the side probably depends on for a lot of its income.
you clearly have not dealt with GDPR. you have 3 options:
1. you do it properly. it will cost a lot of time and money. you will need to hire or sub contract. sometime subcontracting costs even more than hiring.
2. you completely ignore the problem. you hope some activist won’t notify the european authorities.
3. you put up a firewall.
the cheapest and safest route is 3.
has that ever happened?