Hacker News Reader

Comment by mrtksn | Hacker News Reader

I'm sure this will freak out many indie developers, but relax this doesn't affect you.

Just yesterday I stumbled upon a developer video from Germany who was trying to build some AI RAG SaaS for small businesses and was completely overwhelmed with the EU Privacy and data protection regulations and was stuttering when was talking about going to jail for using OpenAI API the wrong way.

Just Wow. These things are not for you, nobody is going to jail for their app or paying life ruining fines in Europe as long as they don't actually cause real harm. All those rules and regulations are intended for large companies who abuse their power or harm large parts of the society by ignoring stuff when not making them profit.

View on HN

The directive contains lighter requirements for microenterprises, in some cases going as far as not even asking them to make a paper trail and just trust their word for it. Of course it's going to hit micro companies less than big companies, who's going to sue a micro enterprise because the atm isn't designed with accessibility in mind

US-centric view here. There's a whole cottage industry of people who look for micro-accessibility-infractions and milk it for everything they can get. Nobody's too small to be sued, and nobody's too small to file a suit.

Any examples of people who got sued?

But what would the benefit be to suing someone small in the EU? It's not like you get money from it.

Maybe that's my next get-rich scheme? I could be filing ADA lawsuits against all websites because they don't have a functional speech recognition interface using the speech recognition environment I am paying for.

That’s not true. There’s a whole business industry in Germany for legal buro’s who specialize in basically extorting business into paying for their services to make their websites or compliant .. or be sued and face a 54k euro fine. I personally, decided to stop doing business in Germany altogether because of this. It’s a nightmare for small business.

Like patent trolls but for Germans?

Yes and No. EU acts are only guidelines and minimal requirements to be implemented by member country governments. There is a problem of gold-plating, overregulation of laws in some countries. In worst cases once you are targeted by audit of law enforcement which may burn all you focus and time, you only dream to close your small business and leave the country.

True, it all depends on the implementation in each country. Any examples of this happening to small developers?

No, this is a directive - they are not being interpreted.

Sorry but this line of "don't worry buddy, nobody cares about your small company" reasoning is dangerous. No reputable company wants to operate in a legal grey zone. Or do these directives and the corresponding laws explicitly only apply to large corporations?

Edit: I'm not complaining about the regulations in this comment, I'm saying that it's bad advice to ignore them just because you're a small business unless there is an exception for them. As it happens, exceptions for small business are planned.

Any examples of indie devs burned by that danger? Don't do shady stuff and you will be fine and if you do shady stuff and push for edge cases and interpretation ambiguities to run your business then study the laws in details and lawyer up.

The basics are simple enough to run a legit business. There are some obvious and basic data protection requirements but I wouldn't call a gray zone unless pushing for it. Also, there's no EU police checking apps for violations etc. You don't just get sued the moment your app hits the App Store.

There is no legal grey zone. Just read the law. In Germany it's the BFSG (Barrierefreiheitsstärkungsgesetz) and it is much more pleasant than this monster of a word let's you assume.

It mainly boils down to: write ARIA tags and adhere to WCAG version 2.1 level AA.

I have no idea why you're replying to my comment, I wasn't insinuating that these regulations are hard to follow, I was replying to someone who suggested that small companies don't need to care about them because these laws are intended for large corporations only and won't be enforced on small business. IANAL but that's advice to operate in a legal grey zone and generally not recommended unless the respective laws explicitly make exceptions for small businesses - which they happen to make but OP failed to mention this.

I don’t know the exact wording, but from the GDPR and accessibility trainings I had to sit through at the enterprises I used to work at, I believe there is a certain size of company under which the regulations don’t apply. That was somewhere in the millions in revenue each year, so if you’re actually an indie-hacker, this should not apply to you. I’ll check if I can find a source for that claim though.

There are some parts of GDPR that are non-negotiable however, even for indie hackers. If you collect personally identifiable info, you NEED a privacy policy, a process for users to get their data deleted if they request it, for example.

Reply on news.ycombinator.com