What region, if you don’t mind saying?
it seems to be for sites like archive.to anyway
These are entire networks doing this probably running a core CMS.
The fixed engineering cost is the problem here.
This obviously won't help if you for example sell your backend access.log to the highest bidder, or do backend tracking somehow.
But it would be embarrassing to admit they can make such a thing.
The problem that Europeans can’t read their news without ads is not a problem they want to solve. They don’t want people reading their news without ads.
Given that premise, there's no reason to want Europeans blocked other than spite or embarrassment.
Simply not caring enough to put in extra effort wouldn't look so bad, but that's why I'm pointing out there's no real difference in effort.
Yes, there is another reason: legal liability under GDPR.
if(maxmind.lookup(request.ip).isInEU()) { return 451 }
if(maxmind.lookup(request.ip).isInEU()) { return $body_text }
> It is way easier than setting up some alternative revenue stream and ensuring that it is compliant.
The premise of this comment chain is already that we are NOT setting that up. My previous comment was NOT suggesting we set one up.
Monetarily, both solutions are approximately equal: get fined zero dollars and make zero dollars. This is all they care about.
You may have a preference for one solution over the other, but this doesn’t mean they do.
I think that the solution that they chose demonstrates quite well that they just simply don’t care.
WJTV’s signal doesn’t even reach across the entire state of Mississippi. Why do you think they even for a moment considered EU visitors to their website? Nobody from the EU wants to know about traffic detours, city council elections, or the weather for the morning commute in Jackson Mississippi. EU readership just isn’t even remotely relevant to their operations.
They made an active choice. Calling their choice "lack of motivation" is not right. They wanted to take the ruder option.
1. If GDPR applies to you and you are not in the Union you must have a designated representing in the Union to receive GPDR requests (both from individuals wishing to exercise their GDPR rights and from regulators). So right off the bat you have to engage some service in the Union to handle that for you. There are such services that aren't very expensive, but it is something you have to deal with.
2. IP addresses are personal data according to many GDPR experts. Normal logging that is done by most web servers leaves you with a GDPR burden to deal with. It seems likely that storing this would be allowed without the need to obtain explicit consent because there is a legitimate business interest to that logging, but you still have to deal with requests from people to delete their data. So more hassle.
3. You will have to keep up with developments as regulators rule on the meaning if the tons of subjecting things in GDPR.
If you are not in the Union but people who are in the Union use your site GDPR applies if either you are:
A. offering goods or services to them (free or paid), or
B. monitoring their behavior as far as their behavior takes place in the Union.
For A you have to envisage offering goods or services to them. The mere fact that they can reach your site and use it is not sufficient.
If you aren't monitoring behavior in a way that makes B apply, then whether or not GDPR applies comes down to whether or not you envisaged offering goods and services to people in the Union. That's a fairly subjective thing and I don't think there have been enough cases involving that yet for it to be clear just what that means.
Blocking EU visitors makes it clear you did not envisage serving them saving you all the aforementioned hassles and annoyances.
If you're confident enough that you have a non-tracking response to EU citizens, then you already did the hard part, and you might as well dump the article contents into that response.
There's a recital (Recital 24) that elaborates on that part of GDPR. From that:
> In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes.
A simple IP based location block doesn't seem like it really fits that, and so wouldn't snare you via the "monitoring of their behavior as far as their behavior takes place within the Union" part of the GDPR's territorial scope article (Article 3 section 2(b)).
If that's the case, then whether or not GDPR applies comes down to whether or not you envisaged offering goods and services to people in the Union (Article 3 section 2(a) and Recital 23).
Blocking would be intended to show that you did not envisage doing so. That gets you out of needing to have a representative in the Union and needing to deal with data deletion requests.
They burden sites & users with billions of extra meaningless interactions every month for no net gain in privacy – and possibly a net loss, by training users to habitually dismiss such popups without thought.
Can you point out a few prominent sites using your preferred approach, so I'm sure what you mean?
In our actual world, the disclosure/opt-in requirement is a major burden, because essentially all of the practicioner/implementers, and the specialist firms now powering disclosure popups, have decided their best way to comply is the first-load pop-up mess we've got now. (That's likely because: there's immense value in being able to track sessions-of-use, for adjusting design, even before any commerce or specific-identity info is disclosed. And that value flows not just to the websites: it helps adjust content/UI for the users, as well.)
Given the actual, observed state-of-the-world, for years now, it would make more sense for the singlular governing entity that created the problem – the EU – to fix this, rather than the millions of diverse websites worldwide.
At the very least, the EU could waive the opt-in requirements for any browser which offers some baseline of user-controlled cookie-blocking – which the ~half-dozen relevant browser engines could easily add. That'd be a far more rational, low total compliance cost, high user-agency solution.
Competition & user self-help had practically wiped annoying modal popups from the web. Then the EU's clumsy, oblivious regulators brought them back.
Tracking (regardless of whether cookies or other methods are used - the dumb idea that GDPR only cares about cookies needs to die) for essential purposes such as maintaining state for shopping carts/user preferences/etc does not require disclosure nor consent.
The problem is a lack of enforcement so widespread that entire businesses now specialize (and thrive!) in providing non-compliant consent flows as a service.
Someone from Europe visits my page. How am I responsible for something they do?