Hacker News Reader

Comment by isodev | Hacker News Reader

As someone who lives in the EU, I see this very often with US based websites - the ones that absolutely need the tracking cookies and the data suckage.

View on HN

For the longest time I noticed that many of those websites, typically small-town newspapers, all ran the same CMS, developed by a former employer of mine. Part of the problem, at least back then, could have been that the CMS simply didn't have the ability to disable the tracking cookie based on visitor settings, and development had pretty much stopped years earlier.

Almost no software ever doesn’t need changing. Anything without some sort of indefinite service contract of some sort is always a bum deal for the buyer.

define "need"?

is this "need for my business model" or "need because we can't send a package without your address"?

EU law makes that distinction, as I understand it. If the cookie is absolutely required to do something the user explicitly (not implicitly) requested, then you don't need consent. If you can get the user to explicitly request your business model including the use of these specific cookies then you're good to go.

I think a lot of it is really just pure incompetence. Some product person was just like "we need analytics" and so a dev just put it in. Probably neither party put any thought into it. The product person was trained to want analytics and the dev just does what they're told.

What do you mean "need"? The only website whose business model is user tracking that I can think of are Facebook and google. Without tracking they would cease to make money.

Other than those two I don't see how spying on users is a business necessity.

They would not, they just serve contextual ads related to the things you are looking at the moment (which often are far better than the tracking ones)

What's the difference if everyone has Google and Facebook tracking embedded in their website? Offloading the spying to these is even worse, because they are centralized and have farther reach.

Doesn't FB get way more money for spy agency/propaganda contracts than for the 3rd party pixels for advertising?

What types of messaging do you see, and on what sites? Asking from the US

Commonly "this website is not available in your country".

Fairly typically applies to small local news websites in the US.

Also some retail outlets. Home depot won't let you see the site from the EU.

Which makes sense as it does not sell there so it does not want to bother with non US laws.

There's a large difference between not selling versus not showing.

There's no incentive for them to even show it.

There is: people do travel.

But not enough to make up for the costs of even thinking about implementing what is needed let alone actually implementing, getting a legal check and maintaining it.

Oh that's common, from when I used to not live in the US. Usually for stuff that the site bought a license to, with region-lock restrictions.

I was imagining a scenario similar to what Facebook is doing in Canada, with messages stating "We cant show you [x] because your government hates free speech" (hyperbole)

Indeed and Facebook is now doing this with Threads - "you can't use Threads in EU because we hate how they make it hard for us to sell your essence to the highest bitter" (hyperbole)

That's almost certainly more about the DMA than the GDPR; they'll be pretty cautious about launching Threads.

I think geo blocking is legal, if it's blanket blocking. However, blocking based on DNT header is probably coercive — even if country is mentioned as excuse.

https://gdpr.eu/gdpr-consent-requirements/

Consent must be "freely given", which means you have not cornered the user into agreeing to you using their data. Requiring consent to data processing therefor excludes consent. You need to be able to say no.

Which is stupid since EU law doesn't apply to them, since they don't specifically target European users

Yes it does, EU considers GDPR to apply internationally and "European user" is defined in such a way that it includes people physically outside the EU.

Last I checked the GDPR applies to EU residents, not EU citizens. In other words: it applies to anyone in Europe, not anyone from Europe.

The legal problem with geo-blocking to work around the GDPR is that the error page is usually not GDPR-compliant either. That said for most US sites which apply geo-blocking this is very much a "we'd rather lose that part of the audience than respect anyone's rights" kind of deal. You can roll out the GDPR-compliant treatment for your US users too and it'll be to their benefit. It just means your broken business model that relies on abusing your users' privacy might no longer work.

Note that there are EU sites that do force tracking ads on their users while still being GDPR-compliant by only doing so after the user has consented to it and offering a paid subscription without these ads as an alternative. So it's not just "but we need ads" but explicitly "but we want to harvest your data and do who knows what with it".

The EU can consider whatever they like but it does not affect the fact that their jurisdiction ends at the border.

GDPR disagrees with you

"Your privacy is important to us. This content is inaccessible in your region" or something along those lines

Sometimes just a simple 403.

Reply on news.ycombinator.com