Hacker News Reader

Comment by jasode | Hacker News Reader

>, Paul Graham came up with the thought, that the EU forces companies to have cookie banners. There is no law for cookie banners. [...] Companies could easily avoid any cookie banner. Just don’t track.

KingOfCoders/amazingcto, of course you are technically correct but Paul Graham wasn't talking about the letter of the law.

Instead, you have to interpret his complaint with the lens of game theory. I.e. The Law of Unintended Consequences that takes into account what companies actually do in response to laws instead of what we hope they will do.

Your blog post focused on good intentions of the law. PG's tweet focused on actual outcome.

View on HN

Doesn't that argument work both ways? If you interpret the EU's regulation with the "lens of game theory", it is an unintended consequence of aggressive corporate data collection. Not sure why it makes sense to complain about the EU and not the companies.

> Not sure why it makes sense to complain about the EU and not the companies.

Unfortunately a non-negligible number of people in tech also have libertarian leanings, with a default “gubmint bad!” position, which makes them easy prey for adtech propaganda.

> Unfortunately a non-negligible number of people in tech also have libertarian leanings

Why is this unfortunate? Because you don't agree with us? The "they would agree with me if they were smarter" trope is tired and gets us nowhere.

> Why is this unfortunate?

GP answered your question, for some reason you decided to cut the quote right before the answer. Here is the part that is missing from your quote which answers your question: '[...]with a default “gubmint bad!” position'

Pretty clearly implying the diminished mental capacity which prevents us from agreeing with him, no? I addressed this above:

> The "they would agree with me if they were smarter" trope is tired and gets us nowhere.

Some people have a default “gubmint gud business bad” position and assume that disagreement is only possible if you’re a brainwashed bootlicker.

I say that’s unfortunate

Perhaps you should consider the possibility that the reason why libertarians assume a default "gubmint bad!" reaction to new policy interventions is that they are sensitized due to decades of experience seeing multitudes of government interventions both (a) to achieve their intended outcomes and (b) create unintended consequences, often worse than the problems they are meant to solve, instead.

Personally, I find it very very strange that many of the people who call for regulation as a remedy to perverse incentives manifest in commercial markets seem unwilling to recognize the existence of even more perverse incentives in the political realm. If people seeking profit sometimes do bad things to get it, why would people seeking political power be expected to behave differently?

That's beside the point. If you are in favour of government intervention you should be all the more interested in good policies that have the intended effect.

Bad laws boost libertarianism.

Also, lying about good laws boosts libertarianism.

At least until you realise what they're doing, then you think they're skeevy corporate toadies with no morals.

How arrogant to assume your position should be the default one, and people who don’t agree with you are - of course - easy prey for propaganda.

Seems to be a common tactic from a certain faction currently in power in the United States.

Not just a US phenomenon - it's gone global

No, it does not work both ways. The roles of governments and corporations are not symmetric.

Good regulation is regulation that has good outcomes. If a law has bad outcomes it is a bad law. You can separately complain about what companies are doing but that doesn't change the fact that it's a bad law.

It is of course debatable whether GDPR as a whole has bad outcomes, but if we're talking about cookie banners in isolation then it certainly does.

Exposing the fact that the entire internet is tracking is actually a good outcome.

> No, it does not work both ways. The roles of governments and corporations are not symmetric. > > Good regulation is regulation that has good outcomes. [...]

You don't seem to explain what the role of corporations is or what a good corporation looks like. If these things are not symmetric, you need to finish your explanation of why or how they aren't.

Corporations and the whole of property rights only exist because of government protection, so it would be pretty audacious--in my opinion--to assert that corporations have no duty to behave to the benefit of society. I'm not saying that's your claim, but I'm curious as to how close you're willing to get to that claim...

Governments are supposed to represent the whole of society. The justification for their policies is ideally based on democratic legitimacy. No entity outside of government can possibly have that legitimacy.

In my opinion it is not audacious at all to reject the idea that corporations should intentionally pursue societal goals or claim to act out of a sense of duty.

Of course we want the effect of what corporations do to be of net benefit to society as a whole. But this cannot be based on their intentions or sense of duty. It has to be based on the systemic effects of them pursuing their own (possibly enlightened) self interest within the framework of the law.

It is for governments to make sure that these effects are beneficial and to intervene when they are not. So the asymmetry I see is that capitalism is a tool of society, not the other way around.

I would regard it as a duty of government to ensure that using the internet is safe and respects user privacy, but not to ensure that the internet has a clean UI. To that extent, I'd argue that the EU is achieving good outcomes. Ensuring a clean UI and smooth user experience is one of those things that should manifest as a result of market economics, but does not manifest because markets don't really work that way.

I see absolutely no reason why clean UX should manifest as a result of market forces. Media consumers, on average, are clearly unwilling to pay for ad-free experiences.

I won't pursue that assertion as it's tangential. I shouldn't have brought it up. The main point is that clean UX is not the purpose of the EU's data laws.

> In my opinion it is not audacious at all to reject the idea that corporations should intentionally pursue societal goals or claim to act out of a sense of duty.

I still find it somewhat silly to reject the idea that a corporation (run by human beings) shouldn't intentionally be evil for the sake of maximizing profit, but I do understand that this is a fairly common Friedman-esque point of view.

But, even so, I guess "duty" was the wrong word for me to use. I more meant that if a corporation does NOT benefit society, we should expect the corporation to stop existing. So, in that sense, there's a "duty" (existential requirement) to benefit society.

> Of course we want the effect of what corporations do to be of net benefit to society as a whole. But this cannot be based on their intentions or sense of duty. It has to be based on the systemic effects of them pursuing their own (possibly enlightened) self interest within the framework of the law. > > It is for governments to make sure that these effects are beneficial and to intervene when they are not. So the asymmetry I see is that capitalism is a tool of society, not the other way around.

I feel like you're circling back around to almost disagree with yourself. Several comments back in this thread someone made a point about "unintended consequences" of the law and applying "game theory" logic to it, and another commenter replied that the companies in question could also have seen the law coming if they misbehaved too badly. That commenter asked if the "game theory" logic shouldn't go both ways, and that we should then blame the corporations for the regulation because the government is just doing what governments do.

You replied that the argument does NOT go both ways because the roles of government and corporations are not symmetric.

But, what you're arguing here seems to be consistent with the view that the "unintended consequences" and "game theory" logic DOES go both ways. You acknowledge that it is a government's duty to intervene when corporations are not benefiting society, and you also say that corporations will pursue their own self-interest within the framework of the law.

I don't mean to put words in your mouth, but the only way I can resolve this asymmetry in my mind is to have a framework where corporations doing things that are bad for society is okay, because the government is supposed to stop them; but if the government is unable to fully stop them from being bad, then it's STILL not the corporation's fault, but the government's...

It just sounds like we've gotten lost in the abstractions of corporations and governments. At the end of the day, these are decisions being made by fellow sentient human beings, and if a corporation's humans make some evil decision, I refuse to let them off the hook with "well, free markets" and "they have no choice but to maximize profits".

>I still find it somewhat silly to reject the idea that a corporation (run by human beings) shouldn't intentionally be evil for the sake of maximizing profit, but I do understand that this is a fairly common Friedman-esque point of view.

On a very general level, the idea is that not every part of a complex system has to incorporate all the principles of the system as a whole. Individual parts of the system can have limited roles and responsibilities. That's fine and it has nothing to do with being evil.

Defense lawyers must defend their clients to the best of their ability whatever horrible things they may have done. Juries, judges, prosecutors, they all have their specific roles to play.

It's the justice system as a whole that should result in justice being done. If everyone involved tried to pursue their own interpretation of generally desirable societal outcomes, the justice system would be unfit for purpose.

And here's the asymmetry again. Those designing the system as a whole have to think about societal outcomes as part of their job (as does every citizen). Those acting in a specific defined role as part of the system can only do that in limited ways or under exceptional circumstances.

Corporations are run by people, but these people act in a limited role that is defined in such a way that pursuing specific societal outcomes does not necessarily boost the likelihood of their personal success or the success of the corporations they run.

If there is a conflict between certain societal outcomes and making a profit then those executives willing to prioritise profits will be the ones running the successful corporations. That's why it's so futile to bet on corporations acting against their self-interest in significant ways. They are systemically incapable of doing that (on average - exceptions are always possible).

That's why I'm saying that if we want to make corporations act in desirable ways, we have to make laws rather than appealing to the conscience of those running the corporations.

>I don't mean to put words in your mouth, but the only way I can resolve this asymmetry in my mind is to have a framework where corporations doing things that are bad for society is okay, because the government is supposed to stop them; but if the government is unable to fully stop them from being bad, then it's STILL not the corporation's fault, but the government's...

The question I'm asking is who can fix a particular issue, and if the issue isn't getting fixed then I'm assigning blame to those whose job it is to fix it.

Corporations collectively can't fix an issue when the only fix is not exploiting a particular economic opportunity. If one corporation stops exploiting the opportunity, another one will.

That said, of course I do blame corporations for stuff all the time. There's nothing wrong with that. Blaming them is sometimes effective consumer power. It can take away the economic opportunity as the reputational damage may outweight the benefits. Blame can also help build momentum for a change in the law.

But if laws are made and they have giant loopholes in them, then I blame lawmakers for doing a shoddy job.

Your framing heavily incentivises malicious compliance. After all if the subjects of regulation coöperate to derail, delay, mislead the public and overload enforcement it's going to have a bad outocme by default.

The main problem with GDPR is the scale of non-compliance greatly exceeds the size of any reasonable enforcement capacity, at least until enforcement catches up.

Of course not. Only titans of industry and the landed gentry of the executive class are allowed to "move fast and break things", "ask for forgiveness rather than permission" and take "imperfect action rather than perfect action."

It's more morally permissible for corporate decision makers to install a global surveillance complex than for civil servants to attempt to regulate it.

> It's more morally permissible for corporate decision makers to install a global surveillance complex

No, it's more transparent. Unlike cookie banners.

If only cookie banners protected the consumer, but shadow cookies work fine.

That's a misuderstanding of the banners. The requirement is to get consent to track someone and/or process their personal information in a way that is not strictly necessary or covered by contract. The mechanism that does the tracking is irrelevant.

Because the companies are getting what they want (data on users), but the regulation is not getting what it wants (no tracking or informed tracking).

I don't know if this mini-competition between regulators and companies is truly zero-sum, there could be some way to get everyone something they want. But with the current regulation, it is zero-sum, and the companies are winning and the EU is losing. And the EU "works for you", so of course you can complain to them.

> the regulation is not getting what it wants (no tracking or informed tracking)

That's an overstatement of the purpose of the regulation IMO. The purpose is to give the user control over the tracking of their data.

OK, fair enough. pg's point still stands I think - I believe that most users have zero idea what that popup is and don't bother doing anything but clicking on it immediately even if they do have some idea.

I find it pretty difficult to be sure what point pg is making, because he uses an ambiguous phrase "good at regulation". What does he mean by "good at regulation"? According to the UK's Institute of Chartered Accountants [0] good regulation satisfies five criteria:

* Transparency

* Accountability

* Proportionality

* Consistency

* Targeting

I'm not certain that the GDPR laws fail any of these. I'm guessing pg is getting at something more nebulous to do with how annoying the UX is as a result of the regulation, and whether it encourages civil engagement. But if he'd simply said "EU regulation has made UX annoying" then he wouldn't have such a snappy tweet.

[0] https://www.icaew.com/technical/trust-and-ethics/better-regu...

EDIT I googled some more and found a brochure from the National Audit Office titled "Principles of Effective Regulation": https://www.nao.org.uk/wp-content/uploads/2021/05/Principles...

It does have a statement in there:

> Good regulation maximises the benefits while minimising compliance costs and unintended consequences. The benefits of regulation can be both to wider society (such as improved environmental or safety standards) and to regulated (for example, through increased consumer confidence), but not all of the benefits are necessarily easy to quantify.

Put that way, I can get on board with what pg's saying.

The blog clearly works from the actual outcome lense. It's repeated. Several times. The companies could just not track.

The actual outcome is that they do want to track, and use adversarial patterns and malicious compliance to twist your arm and "force consent."

Paul Graham is still wrong.

>The blog clearly works from the actual outcome lense. [...] The companies _could_ just not track.

No, you've inadvertently stated a contradiction. Your use of the word _"could"_ is literally a hope/wish/intention of the law.

In contrast, the actual outcome is that the companies didn't stop tracking. We _wish_ they would stop tracking. (I.e. "The companies _could_ just stop tracking us!") But that hope still doesn't change the observation of reality.

The law is not code. Equating hope with the intention of the law is a poor way to think about it. The law is to protect users against opaque companies and to enable them making informed choices.

If companies act maliciously to contort around the law and force users back to making uninformed choices, it is the companies' fault and not the law's. Companies could have followed the interpretation of the law unobstrusively. But they didn't.

Invoking "reality," semanticking a position, do not make Graham's position justified. Neither does it make the blog wrong.

But companies have stopped tracking (or they've started lying). I can now opt out. I could not before.

Can you really say that confidently? I think a lot of these companies would go out of business if they didn't track users so it seems like under the law they have no option but to show cookie banners. Or are you claiming the law exempts companies in such circumstances?

I'm sure illegal/unethical actions would help a lot of struggling companies.

(author here)

I'm a fan of second-order thinking and unintended consequences, so I'm with you there. How would you frame a "don't track people without consent" without unintended consequences?

The article tries to make the point (perhaps fails), that companies do this intentionally to get the "consent" of people against their will, therefor running the tight line of breaking the law without breaking it.

The problems with the current law are:

- no fines for non-compliance (or malicious compliance)

- no legal liability for data leaks of PPI

When businesses believe (correctly or incorrectly) that the benefit of tracking outweighs the cost (annoying users, regulatory noncompliance) they will do it. The fix is to make tracking too costly for businesses.

> - no fines for non-compliance (or malicious compliance)

"The Biggest GDPR Fines of 2023"

1. Meta – €1.2 billion (Ireland)

2. Meta – €390 million (Ireland)

3. TikTok – €345 million (Ireland)

4. Criteo – €40 million (France)

5. TikTok – €14.5 million (UK)

6. Axpo Italia Spa – €10 million (Italy)

7. Tim S.p.A. – €7.6 million (Italy)

8. WhatsApp – €5.5 million (Ireland)

9. EOS Matrix – €5.5 million (Croatia)

10. Clearview AI – €5.2 million (France)

"GDPR fines are designed to make non-compliance around data security a costly mistake and they can be separated into two tiers. Less severe infringements can result in a fine of €10 million or 2% of a firm’s annual revenue from the preceding financial year, depending on which amount is higher. More serious violations can result in a fine of up to €20 million or 4% of a firm’s annual revenue from the preceding year, depending on what is higher."

via https://www.eqs.com/compliance-blog/biggest-gdpr-fines/

Which ones of those fines were because of inappropriate use of cookie consent popups?

You just copy-pasted a list of GDPR fines.

> fines were because of inappropriate use of cookie consent popups?

see: "8 companies that faced cookie consent fines"

https://www.cookieyes.com/blog/cookie-consent-fines/

"In January 2023, France’s data protection watchdog, CNIL, fined TikTok €5 million ($5.4 million) for making it difficult to refuse cookies on its website. The CNIL found that TikTok manipulated consent by discouraging users from rejecting cookies. They required multiple clicks to refuse cookies, but only one click to accept them. TikTok resolved the issue by adding a “Refuse all” button to its site."

Fines for data breaches is one idea? If we want to disincentivize data hoarding, the main cost to data hoarding is data breaches, so we could perhaps penalize that.

This would have a different issue, specifically companies would no longer self-report data breaches, but it's just an idea. There are alternative approaches to getting to "don't track people without consent" that aren't a toothless stick by making it more expensive to track.

Here's my idea - no data collection without compensation. For example, you must pay me in advance 1 cent for the permission to access 1 byte of my personally identifiable information for the following month, whether that's stored in a cookie or in your own database or you access it via a third party (e.g. Meta). So instead of a "cookie consent" pop-up, I want a "cookie payment" pop up where the site will ask me for my payment details and say how much they'll pay me (again, in advance) for each of the options I can toggle.

> the main cost to data hoarding is data breaches

... the main cost at the moment. I think we as a society are very close to a tracking/data tax.

Probably the same way most laws end up. We see the unintended consequences, then revise the law to counter the consequences. Thus the cat/mouse game continues.

An idea could be that the tracking has to be opt-in AND the webpage cannot stop critical use of the page as part of the opt-in process.

Then another round of consequences.. rinse repeat...

> An idea could be that the tracking has to be opt-in

Why would anyone opt-in? Tracking provides zero benefits to the site visitor.

Why does there need a reason for them to opt-in? Maybe they just don't. That's okay. Like you say, zero direct benefits.

> How would you frame a "don't track people without consent" without unintended consequences?

Drop the consent requirement? I.e. just don't track people. No third-party cookies, first-party only, and only for the correct operation of the site.

It's not the cookies that people object to, it's the tracking. Tracking provides no benefits to visitors. If there were no tracking risk, there would be no need to require consent.

> It's not the cookies that people object to, it's the tracking. Tracking provides no benefits to visitors

Sure it does. Visitors get to use all those great sites and apps without paying for the services directly.

That's not a benefit of the tracking. That's a benefit of the advertising dollars.

I have yet to see any kind of meaningful study showing that tracking improves the ROI on advertising by anything remotely resembling enough to justify it.

"directly" does the heavy lifting here. Users (on average) still end up paying for the services in the end.

> Drop the consent requirement?

Don't ask users what they want. Let me, denton-scratch, decide for all of them. Wow, what a brilliant idea!

> The article tries to make the point (perhaps fails), that companies do this intentionally to get the "consent" of people against their will, therefor running the tight line of breaking the law without breaking it.

That X button is right there at the top near the tab name. Not sure how a user could be forced against their will into staying on the site presenting them with a cookie banner.

Everyone knows that bad actors will continue to behave badly in the face of the law. This isn't the insight you seem to think it is.

Really, PG's tweet has little to do with game theory or anything else. It is a first-world-problem whinge about having to click through cookie banners. Assessing the "actual outcome" of complex regulation and legislation is a task beyond the scope of a single tweet.

It might be useful for Graham to determine what claim he is trying to make in the first place. Is he rebutting a particular EU representative for boasting about how good they are at regulation? Or is the idea that the EU shouldn't have the audacity to attempt to regulate in the first place?

I consider it a good outcome when I can clearly identify shitty websites and just click the back button.

Except many companies respond to the cookie law with a cookie consent popup that violates the law (by making opt-out harder than opt-in).

Could we really have predicted from the "Law of Unintended Consequences" that companies would respond not by tracking less nor by giving people an easy way to opt out, but with a cookie consent popup that is not compliant and also really annoying to their visitors?

This is better explained by business operators being ignorant of the actual law and being ignorant of the UX impact.

There are a lot of ridiculous things a company can choose to do in response to any given law. Those choices are not mandated by the law. Horrible consent UX is not the only option to choose from.

Government can, and should, analyze likely (or unlikely) unintended consequences and use those to further shape the law, but at the end of the day, those consequences come from choices that people who are subject to the law make.

I think the big mistake the EU made is they probably thought: “Surely no company would choose to abuse their customers with horrible UI just because they don’t like the law and want to take their collective frustration out on their users!” The EU was obviously wrong about the extent to which companies would throw their users under the bus while maliciously complying.

The actual outcome is, from my experience, that tracking has reduced, a lot. When this law was enacted, *we all removed "like on Facebook"* buttons. Remember those? Yeah, we don't see them anymore. Google Analytics also was forced to change, at least a little.

Is there still tracking? Sure. But it's not so blatant anymore. There are hoops one needs to jump through. And that was the point - to make tracking a harder.

None of my projects have cookie banners. Why? Because I use a first party tracking system (Matomo), I anonymize all visits and I respect DNT. It's that easy.

It’s not the difficulty level that people object to.

It’s a combination of two things:

1) the law comes to the rest of the world from Europe. We (rest of the world) didn’t vote in the people who brought it. We’ve had quite enough of Europeans making rules for the rest of the world in the past few centuries thank you very much.

2) GDPR encodes an expectation that may or may not be common in the EU, but certainly isn’t common elsewhere. I don’t have any expectation of privacy when I walk in public or when I give any information at all to a business. My solution to this is: a) I wear pants outside, and b) I don’t give out private information. Whether the business ecosystem knows their age and purchasing patterns is largely immaterial to virtually everyone I’ve ever met.

And don’t show me a survey showing people don’t like it - if you prime people with the question, of course they will respond that way. They know their info is being gathered, and they just don’t think it’s as big a deal as GDPR would like it to be.

So, I get your point. I can see how (1) can be aggravating. Can't really say anything to defend it, that's the Brussels effect for you. From the point of view of your own sovereignty, it's a bad thing, period. From the point of view of an effect on the lives of average people, I'm not so sure, it's so cut and dry.

Now, point (2) is, unfortunately, in the same vein as smoking, pollution, seat belts etc. Uninformed people (uninformed because they have better things to do) are not protected from their lack of knowledge. They suffer the consequences just the same.

And while I agree that and informed person, making a self-destructive choice has (in most cases) the right to do so, there is something to be said about the very, very powerful exploiting the uninformed. And this is where GDPR comes into play. It's protecting normal people, from a very, very big threat, that is not that obvious and is being wielded by the powerful.

GDPR is one of those laws restraining western corporations from going full dystopian future on us all. I said restraining, to be honest, I think it's just slowing them down.

And as far as surveys go - it used to be the same here. Europeans didn't care and said exactly the same things (i.e. the famous "i didn't do anything wrong, so I have nothing to hide") and then activists worked for years to educate them that, at the very least, it's leading them to buy things at higher prices. Now most people are extremely sensitive to their data.

I get it - what you're saying is a very common-sense regulation. Reasonable people can disagree about this.

But different societies prefer a different balance here.

Americans are used to a more caveat emptor situation. Europeans want more regulation. Which one to choose is a political choice.

What's happening is that the political choice that the EU went with is being forced on the rest of us, whether we like it or not.

With all due respect, you're speaking on behalf of 1 person here, not an entire country of people, and certainly not the entirety of the non-E.U. world. "We" can speak for ourselves, and don't all agree with the views you're ascribing to us. And "I" don't agree with the sort of stereotyping I'm responding to.

I'm personally glad someone is doing something for my privacy here. My own government, due to regulatory capture, is unlikely to act in my best interests here.

Uh, what?

Because the EU is forcing you to do something that you want to do anyway, you now like it?

If you want cookie banner laws in your non-EU country, vote for it.

I don’t want some bureacrat I didn’t vote for issuing diktats that affect how I build my business and my websites.

The entire point is that we all need representatives in government.

The EU isn't forcing me or you to do anything.

The article elaborates on this point: There Is No Cookie Banner Law. Only bad website operators choosing to abuse their users with annoying consent dialogs.

Nobody in Europe is issuing "diktats", meaning citizen-supported legislation I guess, or affecting your business, unless you're trying to deal with their citizens' data. Just don't process EU citizen data and it's not an issue. Better yet, just don't track users.

In any case, your disagreement only serves to underscore that you were speaking on behalf of 1 person, not any country or countries. Otherwise, we wouldn't be disagreeing!

I actually self-host all my web assets and use Matomo already. So I do actually agree with the premise.

What I object to strenuously is someone dictating terms to the world from distant shores, especially since they seem not to get how the internet works (it’s all funded by ads, online sales, and ads for online sales, all of which involve metrics and tracking!)

The diktats I mentioned include a ruling that Google Fonts are illegal now. So if I’m using those, or I’m using Google Analytics, and a European happens across my site, I’m now a criminal? Fuck that.

The consequences of contravening the GDPR are uncertain but sounds scary. This is terrible for the open and free internet.

Please tone down the hyperbolic rhetoric and FUD. Consider how strongly you can make your point without them.

To the point: Nobody in Europe is "dictating terms to the world", or "issuing diktats", meaning passing citizen-supported legislation I guess, or affecting your business, unless you're trying to deal with their citizens' data.

> The diktats I mentioned include a ruling that Google Fonts are illegal now. So if I’m using those, or I’m using Google Analytics, and a European happens across my site, I’m now a criminal?

No, because website operators have at least 4 more options:

1. Don't process EU citizen data (block them).

2. Don't track users, period (host the font on the site instead).

3. Don't track users until they log in (convert them).

4. Get users' informed consent (let them know that they'll be tracked on the site due to the choice of google fonts instead of hosting a font).

Wow, that wasn't scary at all! The general attitude I'm getting from some folks, though, is that they want to do anything they want to users without consequence and never change. This attitude is going lead to a lot of anguish. Others have rights, too, and they override our right to do whatever we want to them, in many cases.

Here's the problem.

> 1. Don't process EU citizen data (block them).

Many webmasters have neither the time nor inclination to read up on EU law. So blocking is the easiest and safest solution to minimize our legal risks. This is absolutely terrible - I grew up dreaming of an internet that is really humanity's network; not islands separated by political allegiance.

I agree that I can tone it down, but 99.99% of the FUD around is directly the fault of the EU for not making it crystal clear what the theory and practice around their internet laws will be.

Luckily that's just 1 of the 4 options, and those 4 options are just 4 of many options, so no need to focus on 1 of many and say you don't like it: you can just choose another! Or you can choose to create the islands. I don't see what's so terrible about that.

Did website operators think they could keep violating the rights of EU citizens indefinitely? I mean, based on enforcement capacity, chances are most operators can, but it'd be good to stop. IMO, A network for humanity should prioritize humans and their rights, over tracking and ads, and the lack of respect for those rights is what I find terrible.

Real talk: if you have questions about the GDPR, ask them, and I'm sure the smart folks at HN will be able to help you find answers and overcome obstacles. You can build and not break laws, whether GDPR or ITAR, we can help. Nobody's saying it'll be zero work, but nobody's entitled to run a business doing whatever it wants with zero work, either, and shouldn't expect to.

You keep missing my point, possibly on purpose, so I'll end this here.

The EU and the US and China disagree about what user rights are and what reasonable behaviour for a website is.

If one of those parties enforces their vision onto their traffic, it has a chilling effect - splittig the net into federations. By making GDPR super vague, the EU just makes everything worse, including for Europeans. If you disagree that the rules are vague, I'll refer you to the rest of this thread. Nobody knows what's being enforced or what the penalties are.

As far as the GDPR goes, only webmasters choosing to ban entire countries of users out of greed (wanting to unfairly profit off users) or laziness (not caring enough about the privacy of their users) or spite (punishing users because you don't like the GDPR) can achieve the splitting you describe. If it happens, it would be their decision, and thus their fault.

Real talk though, again: you say you personally feel the GDPR is vague. If you have questions about the GDPR, ask them, and I'm sure smart folks at HN will be able to help you find answers and overcome obstacles. You can build and not break laws, whether GDPR or ITAR, we can help. If you have troubles building, share them with us, let us advise you. Nobody's saying it'll be zero work, but nobody's entitled to run a business doing whatever it wants with zero work, either, and shouldn't expect to.

I see your point, but then to have a constructive conversation Paul Graham should also give his two cents about how the law could be improved. I don't know him, so I'll ask here: did he do that?

Paul Graham focused on whining about regulation as he always does

The outcome would be much better if the law explicitly stated that the initial cookie banner must have a "Necessary cookies only" opt-out one-click option. And that this option means truly necessary, not the Internet Explorer is needed by the operating system 'necessary'.

It’s unfortunate, if companies are okay not tracking you, that they care little enough about their user experience to use cookie banners.

I’m not surprised. This is a “hot take-centric” platform issue, and a laziness in trying to understand him too. Or.. two people on the street yelling at each other but not listening.

Reply on news.ycombinator.com