It's available in 174 countries.
Europe has gone to great lengths to make itself an incredibly hostile environment for online businesses to operate in. That's a fair choice, but don't blame Google for spending some extra time on compliance before launching there.
Basically the entire world, except countries that specifically targeted American Big Tech companies for increased regulation.
> Europe has gone to great lengths to make itself an incredibly hostile environment for online businesses to operate in.
This is such an understated point. I wonder if EU citizens feel well-served by e.g. the pop-up banners that afflict the global web as a result of their regulations[1]. Do they feel like the benefits they get are worth it? What would it take for that calculus to change?
1 - Yes, some say that technically these are not required. But even official organs of the EU such as https://europa.eu continue to use such banners.
Now I'm feeling how bad it is on the other side of the fence, and the funny thing is people don't seem to give a shit because they never experienced decent regulation and being fucked by brands is just the way of life.
But maybe it shouldn't be surprising given the example of Google's precedent-setting profitability from guiding that particular path.
decent regulation like the cookie policy bullshit that makes people waste 30 minutes per day? Thanks bud
But I'm guessing that it was lobbied against. Similarly, it has generated a large industry in cookie compliance services.
As regards the lesser availability of American tech, I'm sure that's much more limited in China, which coincidentally happens to have the most notable domestic AI industry outside of the US. It's something that economists can be reluctant to admit, but for which there's solid evidence by now afaik, that at least temporary import barriers, if done right, can be a boost to industrial development. The thing that is weird about the EU regulation is that they're putting the same shackles on their domestic tech industry, which is dwarfed by the giant US incumbents who have more resources to invest in compliance than startups (apart from the bits that apparently only target said encumbants that some posters have mentioned here, which I don't know anything about).
Again, folks say the cookie banners are not required, but even the EU web managers are unable to build a site without them. So maybe they are "practically" required for all sites?
> they're putting the exact same shackles on their domestic tech industry
The Digital Markets Act is an attempt to fix this by targeting the American tech companies specifically, without explicitly naming them in the law. I would venture that the DMA is why Gemini isn't available in the EU right now, like it is in the rest of the world where US companies are allowed to do commerce.
No, it's targeting all big tech companies, not only American.
You can stop this pathetic lament that the evil EU is attacking innocent American corporations. It's typical american ignorance.
I don’t know which case is true but there are multiple interpretations, unless you’re saying this based on some fact?
Given the timing of the most recent EU review plus where OpenAI was in its growth curve at that time, they simply didn't fit the criteria, which were written to allow companies as big as Spotify to escape the regulations.
On the first point, I think user rights trump developer convenience, so I stand by what I said.
I agree, this may be good for Europe in the long term. However, one would expect to see the protectionist measures coupled with similar measures intended to generate competitive native alternatives. Limiting the expansion of Boeing is great, as long as you have Airbus. Without Airbus, you're starting to make some real compromises.
> to anyone who thinks the US isn't doing the exact same thing
US is currently playing both sides of this in the chip space in an attempt to wrestle some of the power back from China. Unlike the DMA, the US effort is putting a lot of money on the line to help build local alternatives.
IIRC Cliqz was an EU-financed search engine project that looked like it was going to be a contender, but I think Covid killed it. Projects like that could be the way.
In all fairness, there are some genuine European players in the AI space (eg Mistral), and they also produced one of the early global hits (StableDiffusion, which was largely developed in Munich afaik). But if you look at the overall footprint in AI (research output at top conferences, patents (which are basically impossible to get for anything software-related in the EU),...), Europe seems at risk of hopelessly falling behind. And in the face of that, it's concerning that policy makers' chief concern seems to be further curtailing it.
This is malicious complicance.
The laws themselves say that rejection should NOT be more difficult than accepting. You can make it as complicated as you want, only if the acceptance process is equally or more complicated.
They have a pretty interesting explanation of each cookie they use:
https://european-union.europa.eu/cookies_en
What I never quite understand is the analytics issue. We had server logs for analytics long before everyone started using cookies for that.
In my opinion the cookie part of GDPR is clearly bad regulation. It requires cookie banners for some things that are not privacy issues. And at the same time it doesn't institute a sensible consent mechanism that doesn't in practice amount to constant harassment.
IIRC a server log that retains IP addresses is covered under GDPR and may itself require disclosure via e.g. a popup. (IP addresses are part of the protected class of personal data.)
More to the point, server logs != modern Web analytics. Modern Web analytics require someone to ingest lots of data and run an app to allow users to analyze that data. Common practice outside of sensitive industries like healthcare and finance means offloading all of that ingestion/storage/management/analytics to a third party, hence 3P cookies.
It is covered under GDPR but I think the general consensus is that server logs containing IP addresses do not require consent. You just need a legal basis for collecting the data and this has to be spelled out in the privacy policy.
>More to the point, server logs != modern Web analytics.
Being "modern" is not a sufficient explanation for why it is necessary. Using third party services does not generally require consent either.
It's considered commercially necessary because reading through logs is not as effective as using a Web tool like Google Analytics for the task of understanding what users are doing on a website.
If you want to make the argument that there's no difference between using e.g. Unix tools on a log file and using a tool like Google Analytics, that's your prerogative. But the industry as a whole disagrees.
It depends on the legal basis. If you store these IPs to render service or combat fraud, you might get away from explicit consent. However, if you use and store these IP addresses for analytics, then it is a very different conversation.
GDPR is not just about what and how you collect and use data.
Indeed it does. So it will come down to the specific purpose of any analytics.
Consent is only one of six different legal bases that can justify processing personal data.
I've stressed this elsewhere but I feel it benefits from more people seeing this - you can block these just like you block ads.
Ublock origin for example, have a look at the filter lists and add on "annoyances". This can also get rid of lots of chat widgets and similar.
I don't get spam mailing lists or robocalls. I can safely sign up to services knowing I will be able to unsubscribe easily. I can buy things online knowing they can be easily returned.
Yes, some of my clients lament the inability to use those patterns. I politely smile and nod.
Also with an ad blocker, see if you can turn on hiding the banners. Without you clicking "yes" they can't use consent for a reason, so this is equivalent to clicking "no".
Not strictly true. I get robocalls and WhatsApp spam messages from country code +1 all the time.
It was a bit of a pain to manually reject all the _purposefully_ annoying cookie consent banners that companies started pulling, but now there's plugins for that, which rejects everything for me by default.
Is it possible for the law to be amended so that non-EU citizens can use a browser flag that just says "I'm fine withe the cookies"? That way Europeans can enjoy all the cookie consent clicking and the rest of us can go back to how the web was before?
But once too many people switched it in the 'do not track' mode, the industry decided to simply ignore it.
You cannot get a more clear sign that government pressure and laws are needed, than that.
My recollection was that it was Microsoft deciding to turn this flag on by default that led to it being ignored by Google. I.e. Microsoft saw a chance to use it against their biggest rival, diluting it in the process and gaining nothing.
I think there's an argument for trying again but requiring an explicit choice. And then give it the force of law.
Yes, because I can tell them to fuck off from harvesting all my data and have an easy, legally enforceable way to tell them to delete whatever data they've harvested off me. I've reported a few websites that have done shady shit with the cookie banners and even saw them get some fines, so I'm perfectly happy that companies can't hoover up any and all data about me that they want to feed the pockets of some rich assholes an ocean over.
If a company can't exist without massive privacy violations and personal data exfiltration then they deserve to die.
you are living in a dream. the NSA collects data on everyone and you can't delete your data there.
Perfect shouldn't be the enemy of good. I don't like that gov't agencies do it either, but that doesn't mean I'm not happy that there's at least some consequences for others that are trying to do it. Also if a nation-state level entity is targeting me specifically, then I'm screwed even if they don't have any of my personal data.
Yes, "you chose to use them so you decided to follow their terms of use and privacy clauses" but key here is how you're more and more often required to use certain services online or you're put at significant disadvantages ranging from keeping in touch with your family or friends to being disadvantaged in the job market.
* https://blogs.windows.com/windows-insider/2023/11/16/preview...
And even though I tend to complain about UNIX like OSes, maybe they are the key to free Europe from US corporations operating systems, like a few other countries are already doing as well.
We should stick to international regulated programing languages and OSes, that free us from dependencies on export technology regulations.
Which is their prerogative[1]. I'm just pointing out that the people who run the EU's official websites aren't able to operate inside those bounds, so it's fair to say those bounds are not commercially reasonable in general for functional sites. QED the banners are de facto required.
1 - The extensive reach of the law is breathtaking. The EU claims jurisdiction over any web property, based anywhere in the world, that might be seen by an EU national.
For example, the European Parliament website uses third-party cookies for analytics and for Web streaming. Yes, they can run the whole stack themselves. It is also a) more work and b) not how most of the industry works.
The European Parliament with the resources of the EU, finds it expeditious to use 3P cookies and just display a cookie banner. How reasonable is it to expect sites with fewer resources to do similar interesting things on the Web without also falling afoul of the EU law?
What you are looking for is a way to use these tools, of which you don't really know what they're going to use this data for or how and why they are tracking me, without my consent.
I find it very strange that this is something you object to.
We are saying the same thing. Yes, you can use the tools, but then you require consent from the user as the very first thing they see on your website.
> I find it very strange that this is something you object to.
As a non-EU national, I don't derive the benefits of Do Not Delete etc. I do not ever care that a site is using 3P cookies to do e.g. on-page analytics. The cookie banners are a net negative for me.
> We are saying the same thing. Yes, you can use the tools, but then you require consent from the user as the very first thing they see on your website. No, you only require to get consent from the user before you start using the tools. That this is as soon as they enter your website, and thus you need to ask consent as the very first thing they see, is your own choice.
> As a non-EU national, I don't derive the benefits of Do Not Delete etc. I do not ever care that a site is using 3P cookies to do e.g. on-page analytics. The cookie banners are a net negative for me. I'm sorry that you're not getting any benefits from it. That said, blame the site owners for incorrectly identifying your IP as a European one.
I have no good reason as to why the EU live stream has 3rd party cookies. However I set up online streaming for two small TV stations in my country, they wanted you to be able to watch the channel live on the station's website, we were able to see how many people were watching the stream live and I never had to use 3rd party cookies. It's not that hard to set up and it is cheaper than you'd expect now days, even video capture cards/devices are much lower price than back in the day.
The marketing department typically is important to businesses.
For all I care your site isn't required to be commercially viable. If you aren't able to convince the customer and instead opt for so-called cooky-terror banners as a dark pattern with the primary goal of de-sensitive-izing users, you don't deserve my cooky. Opt-in means legislation has passed this view into law, with the quirk that the dark-pattern is fully expected because the industry needs a sort of legitimization for the use of private data. Small companies usually suffer under compliance, no doubt.
Besides, what has this to do with AI prompts? No doubt they want to analyse every single interaction as a sort of supervised training for free. This does not rely on third party cookies, but it might benefit from making identifications which somebody could argue are not essential to the service as advertised.
Is that the kind of tooling that site operators have grown to find indispensable over the last couple of decades, that you mention?
It's related via my question about EU digital regulation, although Gemini is likely on hold due to the DMA and not GDPR. The question was more about how willing are EU residents to forego technological advances under their more muscular regulation regime.
Not really, it's about the rights of people represented by the EU.
By analogy, it would be like the US asserting that the Constitutional rights of its citizens travel with them, and so they have the right to carry guns in any country.
It's an expansive approach.
It is.
> The EU claims jurisdiction over any web property, based anywhere in the world, that might be seen by an EU national.
Not really! The EU simply claims jurisdiction over any company that trades in the EU. The company doesn't have to be a "web property" - if you sell cars, or food, or medcines in the EU, you have to accept EU jurisdiction. If you want to operate a web property that is accessible in the EU, that's fine; but don't have a EU trading arm if your web property isn't GDPR-compliant.
The EU claims jurisdiction, they just lack an effective enforcement mechanism for sites that do not have a financial nexus inside the EU. (Perversely, this creates an incentive to not create such a financial nexus, including hiring anyone inside the EU.)
Absolutely. It goes far beyond cookie management, it's a fundamental thing about what you're allowed to do with my data without my consent.
You know you can block them right? Ublock origin has "annoyances" in the lists, just tick that.
1) Causing massive pollution of the Web and then saying this to the 95% of the world who are not represented by the EU is tone-deaf.
2) This is an added tool that has to be installed, meaning most people will still experience the popups.
3) uBlock origin has limited browser support. Telling the world they need to browse the Web differently is an answer that is only a variant of the pop-up problem that also tells users to brows the Web differently (by navigating popups).
you know quite a few people use the things called mobile phones?
As others have said, get a browser that supports addons and enjoy browsing the web without ads and these banners.
It is very annoyous but it is also the choice of the sites, you can put a discret banner at the bottom and not disrupt the reading if you want to not annoy people.
These "regulations against us giants" may also have positive effects. They forced Microsoft to offer a choice of browsers on Windows, something requested by Firefox and Opera and that killed Internet Explorer and permitted modern browsers including Google Chrome to florish.
Wasn't this an outcome of the US antitrust trial against Microsoft in the late 1990s?
The cookie banners are a bad outcome for sure, but GDPR does not mandate them. They are an indirect result of the bureaucracy installed by GDPR which does not incentivize user-friendly design of privacy-aware features. I don’t want GDPR rolled back, even as a software developer, because I think it creates the kind of protections everyone in the world should have. But I would like a rule clarification on how to build compliant websites without cookie banners, so I blame the administration (the EU commission) but not the legislation.
The digital markets act similarly is the kind of regulation we need everywhere. It’s only hostile to online businesses because other places don’t have those kind of guard rails on the abusive behavior of big tech.
Now, as far as the EU AI act. I think that in its original intent when it was specifically targeting things like public face recognition by governments it was a very good idea, but it has been hijacked and in its current form it would be very harmful if passed. I don’t think it particularly targets american tech companies, because the biggest victims would be EU AI startups like Mistral.
Not only that but the terrible banners you get are very often not compliant with GDPR.
GDPR doesn't target American tech companies, that's the DMA. Essentially, the framing is there are companies that are "gatekeepers" and then everyone else. The criteria for gatekeepers are theoretically objective, but they were written with a specific set of companies in mind. As a consequence, the designated companies except TikTok just so happen to be based in the US. Further, the rules were written such that EU firms like Spotify are not eligible.
Also, Vodafone somehow is not considered a gatekeeper in any relevant digital market.
Anyway, no judgement. We are in a time of rising protectionism. This may be good for Europe. But the DMA clearly targeted a set of West Coast US companies and it's doing what it was intended to do.
I do wish they would modify GDPR to only apply to people e.g. physically in Europe or similar. It really does make the Web worse for billions of people who are not EU nationals and derive absolutely no benefits from the banners.
While they're regulating browsers and plugs, could they make browser makers ship EU versions of their browsers that show the popups, while the rest of us save tons of clicks? EU nationals could install EU versions of their favorite browsers and the rest of us would just use the stock versions.
It's hard to say Instagram, Meta Marketplace, and TikTok are gatekeepers (they has been designated thusly by the EU) but Vodafone isn't.
The law is protectionist, which is fine in itself. But the argument that Instagram is one of the core gatekeepers of the Internet and Vodafone isn't is ridiculous on its face.
Netflix isn't being targeted either, so it's obviously not purposefully targeting FAANG/M$ and nothing else.
I did not say that anywhere.
> Or are you saying that Tidal, Apple Music & Deezer should also be targeted by DMA?
I'm just noting that it's curious that the DMA criteria were written in such a way that they exclude the largest consumer Internet company in the EU. That's it, nothing else.
Spotify ain't gatekeeping anything so why do you think they should be eligible?
And also let me mention the unified usb-c atpater regulation, the opening of messenger protocols and app shops! I honestly believe the EU is making tech better for the whole world!
Thats the same EU which is trying to break encryption we are talking about?
This needs to be more widely known.
Also, because they need active consent - any cookie banner blocking extension (weird to see so few people talk about this when it's seen as obvious we need ad blockers) means no consent and is perfectly fine under GDPR. You're not required to signal "no".
wildly overhyped AI toys that are not even available in the countries where they launched (Gemini Pro is not multimodal as others have pointed out, Gemini Ultra will be available only next year)
you're picking out the cookie banner (which is annoying mostly because companies aren't implementing it properly) which is just a small part of a wealth of regulations which give us control over our data. and then you're ignoring all the other extremely valuable regulations that protect customers. and online shops are still able to make a profit here. they just can't completely abuse their customers as they please. yet. for the most part.
That said, as with most heavy bureaucracies there's just not enough internal organisational tech education so lobbying and misunderstandings end up diluting the process.
Example is the cookie banners leading people away from smaller competitors strengthening monopolies, and teaching people to click at 100 banners a day because no one has time to read so much.
Another is GDPR policies which are great but a huge hassle for smaller orgs and companies, and not really targeted them in the first place.
Everything always ends up a win for the largest players, while the smaller ones struggle to maintain legality.
That has been my experience with a few GDPR processes.
Another annoying thing is the forced Public Procurements of software solutions if you're more than 50% publicly funded in EU.
Again good intentions but it just makes the big players hire huge amounts of lawyers and sales people to game the process to win then create bad software.
That's the problem with regulation. The free market is definitely not free after consolidation and monopolisation but if you're going to regulate you need the absolute best consultants to guide the process and somehow that step always gets bungled.
Also, you see how hostile some stuff in the US is to non-US visitors. Lots of local US news sites, for instance, just throw a plain HTTP error at you because they don't want to mess with GDPR.
Sadly the EU is being led by a clique of unelected beaurocrats (commisars - like in the USSR) and the most democratic of institutions - the EU parliament as well as national parliaments have very little influence on what is being proposed and bulldozed in. For example, let's say in a given country literaly everyone is opposed to ACTA and the country has the balls to veto it (despite the beaurocrat's usual tricks of rolling in together things everyone wants and needs with absolute crap like ACTA). The same idea is brought back again 2 years later (ACTA v2). It is vetoed again, it is brought back again 2 years later and this time bypasses the veto by being "voluntary". "Countries that don't want it don't need to implement" - great on paper. Until you realise most people in the EU oppose it, including in the countries that implement it and by the fact of implementing it in the majority they make it a de-facto standard which increases the cost of doing business affected in the countries that now have differing regulations.
Same thing is being done with the "EU constitution". No one, other than it's rulers, wants the EU to be a country. The idea got shot down immediately in a popular vote. So they are essentially implementing it anyway bit by bit by stretching the law and outright breaking it (especially against countries that vote in parties that are not in the EPP club).
I'm a big fan of the idea of EU as it was before the treaty of Nice. It was a group of countries with similar values creating an open market and agreeing to make decisions affecting it together. Sadly the institutions that were created to oversee that structure have the priorities of their own (increasing their own power) and using both the method mentioned above and simply doing things "extra legally" (as lawyers say) they do whatever they want and if the extremely corrupt "court" tied to them decides it's OK there is no way to question it. These bastards say they are "strenghtening the EU". They are destroying it. Anti EU sentiment is increasing especially amongst younger voters in many countries and guess who will be very happy when it all goes tits up? One guy called Putin who has been financing a lot of the corruption we see (through countries like Qatar etc).
That's exactly why the nationalistic resentiment in Europe is so dangerous - we all know all to well what exactly it can culminate into. Unfortunately, I don't see a trend towards fixing the problems within EU - the beauracrats fully embraced old european maximas, "After me, the flood" and "Let them eat cake". Someone should remind them where all that leads to.
https://en.wikipedia.org/wiki/Commissar
TL;DR A commissar is the USSR was a term with several meanings: a political officer in the armed forces, a government minister, and a bureaucrat responsible for supplies.
EU commissioners are really political appointments to head-up civil service departments; so they are more like ministers than anything else. I think that when most westerners think of "commissar", they think of a militarily-incompetent political officer in an army unit, who can overrule the military commander of that unit. There's no equivalent role in the EU bureaucracy.
FWIW, the USA has commissars; they head up armed-forces commissaries, i.e. they are responsible for supply and logistics.
I really wonder how changing an LLM underpinning a service will influence this (I thought compliance had to do with service behavior and data sharing across their platform -- not the algorithm). And I wonder what Google is actually doing here that made them suspect they'll fail compliance once again. And why they did it.
ChatGPT available in Europe.
Google has far too many services and products which are always touching the boundaries defined by the EU privacy laws. they trip the line with anything and the regulators can make it much harder/costlier for Google to do business in EU.
That doesn’t matter for regulators.
https://news.ycombinator.com/item?id=38553635
No judgement, this may be good for Europe in the long term.
Laws are not the issue, their model being crap at non-english languages is.