Hacker News Reader

Comment by advisedwang | Hacker News Reader

This website is a small, local company. They have a newsletter signup page so they do collect user info. Quite likely they are not GDPR compliant (e.g. take longer than 30d to delete records, don't have a process for answering data requests etc). It is reasonable for them not to want to invest in getting the legal advise to know whether they are compliant or process improvements to become compliant, as there is no ROI on that.

I love GDPR, but it's understandable for folks with no connection to the EU to just nope-out.

View on HN

I’m still not clear why US companies with no business units in Europe feel the need to make any changes at all to be in compliance with a law that has no jurisdiction over them, but agree that Geofencing is a cheaper solution than asking a lawyer.

The GDPR states that websites that serve EU citizens are subject to it, no matter where they are. Many US news organizations chose to geo-block the EU rather than going to the trouble of figuring out compliance.

The GDPR can state whatever it wants but what are the consequences? If the taliban pass a law about what is required to serve websites in Afghanistan, for instance, what obligation am I under to even notice?

If I am Reuters and AP and have offices in EU of course I am interested in complying with local law, but it doesn’t make sense to me for a local newspaper to care whether they are in compliance with foreign statutes.

Westerners don't travel to Afghanistan. Europe is not a pariah continent. Does this really need to be explained to you? You think global integration with Europe vs Afghanistan is comparable?

Obviously an extreme comparison to make a point because either way it’s not going to result in me being extradited

Still I will maintain that individuals are not going to face repercussions on vacation because they happen to manage a web property out of compliance with GDPR

Yes but it means serve them specifically. If the main audience is US and some EU visitors happen by, it's not violation. Or at least it's not enforceable violation.

And that might even be true. But it's still at least an hour of retained council's time to deal with it. It's not even 90 seconds to find the geo filter button in your CDN of choice and save you the trouble entirely.

The truth is every single website with Google Analytics and no consent screen is in violation so I imagine whoever is in charge of enforcing GDPR has long ago decided to pick his battles.

> The GDPR states that websites that serve EU citizens are subject to it,

The GDPR can state that they're the masters of the universe but that doesn't make it true. They lack jurisdiction, they can't sue in US court. The EU suing an US entity, in US court, for breaking EU law sounds like a great comedy I really want to see.

If the EU doesn't want EU citizens to use some service located in another country, they should stop their citizens from going there, like at the border, like blocking the IP, domain, etc.

Nonetheless, some people have decided that the risk isn’t worth it, and have decided to geo-block the EU.

You can choose differently, of course, and I’m not making value judgments here. Just explaining why a small local news site would geo-block the EU.

> Many US news organizations chose to geo-block the EU rather than going to the trouble of figuring out compliance.

Funny init.

Rather than do the ethical thing and treat their own (American) users personal data with respect, they instead geoblock an entire continent.

Because they have identifiable owners who might wish to travel to Europe and not risk someone deciding to make an example of them.

You're making the point even stronger for US companies to just block EU traffic entirely. If you have no EU customers, the mere act of letting EU visitors on your site might cause an EU country to "make an example" of you for incorrect data handling, but the alternative of just blocking all traffic would let you travel to the EU without issues.

Well, my point was that a site owner shouldn’t even bother with geofencing, but I guess I’ll accept “may want to travel to europe someday” as a reason to fear legal repercussions

the idea of the owners of a small, regional US news website being arrested while traveling in Europe because that site does not have a GDPR compliant cookie policy seems utterly detached from reality

I would be more worried about being struck by a meteorite than such a thing

It is vanishingly unlikely, or would have been, but given that the US has started examining people’s social media, it is not unreasonable to think tit-for-tat might happen.

Again, I agree it is very, very unlikely. But it’s possible, and in an age of mass outrage it isn’t incomprehensible that some activist, somewhere, might latch onto something they don’t like and just doggedly pursue someone. It does happen.

They geoblock EU users so that the EU doesn't have jurisdiction over them.

Reply on news.ycombinator.com