List of Websites not available in the EU because of GDPR
data.verifiedjoseph.com
data.verifiedjoseph.com
1. A pop-up notifying the visitor on the website's cookie policy (required by EU law).
2. A pop-up asking the visitor to consent to its privacy policy (required by EU law).
3. A pop-up asking the visitor if they'd like to subscribe to its newsletter.
4. A pop-up telling the visitor that it's run out of "free articles", but that you can sign up at a premium.
5. A pop-up asking the visitor to turn off the adblocker because the site's revenue depends on the ads.
6. A pop-up asking the visitor to participate in an online survey.
7. A pop-up telling the visitor about a unique way to earn money in your underwear.
None of the pop-ups will share UI for closing them, and some of the close buttons will be so hard to press that you accidentally change site instead.
(Clarification: It doesn't have to be a pop-up, but it does have to be annoying.)
The consent might be asked when you navigate to next article within the website, but majority of people don't.
It's this simple, and yet everyone on the internet freaks out like having a GDPR-compliant general purpose website is some massive undertaking.
I can't fathom how people got so used to endless tracking that a non-tracking site now literally seems like a impossibility to them.
All in all, it's pretty sad.
Business wise, not so much. How do you monetize such a site? Even a simple commerce site needs to keep tracking of users, and to do any kind of marketing you need explicit user consent.
Functional cookies like this are exempt from GDPR's opt-in requirement
* user‑input cookies (session-id) such as first‑party cookies to keep track of the user's input when filling online forms, shopping carts, etc., for the duration of a session or persistent cookies limited to a few hours in some cases
* authentication cookies, to identify the user once he has logged in, for the duration of a session
* user‑centric security cookies, used to detect authentication abuses, for a limited persistent duration
* multimedia content player cookies, used to store technical data to play back video or audio content, for the duration of a session
* load‑balancing cookies, for the duration of session
* user‑interface customisation cookies such as language or font preferences, for the duration of a session (or slightly longer)
* third‑party social plug‑in content‑sharing cookies, for logged‑in members of a social network.
This means you could freely use cookies for normal operation. It's only when you start tracking people you needed to ask their consent.
[1] http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm
Nobody knows how EU DPRs will define "need" and therefore, to be safe, you just always show the warning. The cost of the warning is low. The cost of being found in violation is high.
Avoiding this sort of outcome is basic stuff, law-making 101, but the EU's output of low quality rule-by-law not rule-of-law regulations makes it seem like they either don't know or don't care.
That isn't the claim. The claim is that a bunch of cookies are specifically exempt from the law and the law tells you that you don't need to put up cookie banner click-throughs. And also that everyone ignores that, and puts up the banner click-throughs anyway and then moans about EU law.
https://github.com/ryanbr/fanboy-adblock/blob/master/fanboy-...
We need a combined Decrap extension that kills all this crap and presents a clean browsing experience on a fresh browser.
With a UI that deliberately makes it very cumbersome to opt out and very easy to opt-in with no obvious way (aside from clearing all browser cookies) to later change your mind...
> (required by EU law)
Contrary to what the sites imply, the pop-up is not required by law (I'm guessing you, sshine, are well aware of this, but the general public aren't). It could easily be an in-page (rather than over-page) or interstitial page politely requesting that we agree to the cookies being stored on later page views.
The request to opt-in is required by the law. The pop-up is required by the site's desire to make it inconvenient for you not to.
> (required by EU law)
While we are on the subject of the law: the way many sites implement the consent walls is not compliant anyway. A common issue is storing data in tracking cookies until opt-out rather than not storing it until opt-in. The other common flaw is one is mis-classification of stored content: should that cookie for doubleclick.net really be classed as "essential for site operation"?!
> in Firefox at least no cookies are shared between public/private
That is also the case for incognito/private/what-ever-they-brand-it mode in Chrom{e|ium}, IE, Edge, and I assume (though I haven't tested this myself at all) Safari and others too.
Though there are some clues that can leak from normal to private due to known bugs & edge cases in the browsers and common add-ons (like flash), search for "evercookie" to find some references about that, and there are other ways to fingerprint or track you which might be less reliable but still apparently work well enough for people to use them.
Because I can't see the CookieBot pop up anymore I can't dismiss, but it prevents scrolling from working on a large number of websites.... All news websites interestingly enough.
That is both not required. Just don't collect PII and all is good. Apple for instance manages to run a website that does not involve any stupid cookie warnings.
> 2. A pop-up asking the visitor to consent to its privacy policy (required by EU law).
You never need both. GDPR superceded the "Cookie Law", so the cookie policy pop-up is no longer needed. You may not even need the explicit consent popup.
You do need user consent for storing user personal data, if you gather, store, and process personal data. Even then, you only need explicit consent if none of the other implicit authorizations apply: https://gdpr-info.eu/art-6-gdpr/
Not always required by EU law, but always always blamed on EU law.
> 2. A pop-up asking the visitor to consent to its privacy policy (required by EU law).
Not always required by EU, but always always blamed on EU law.
One of the sites on this list is the Aiken Standard. We're talking a local newspaper serving Aiken, SC - a city of less than 30,000 people. Even if an EU citizen (or someone traveling in the EU) cared about their local news, it's simply not worth it - that's not their audience.
> At the very least there are additional record keeping steps, policies and procedures to draft, the appointment of a DPO that responds to requests for access or erasure, and the development of the features to fulfill both of those requests.
* "Record keeping steps" are not needed if you don't keep records (which is what you should do);
* "Policies and procedures" are what you should already have, of course, and GDPR didn't change that in any way;
* A DPO must be appointed only if processing the personal data of your customers is your core activity;
* Developing features to fulfill requests for access or erasure isn't necessary if you don't keep records.
The Aiken Standard doesn't have to worry about GDPR just like a small town newspaper in Spain doesn't need to worry about complying with every privacy law that every US state decides to implement in the coming years (following in California's footsteps).
There is a vast misunderstanding of how jurisdiction works and how it's going to play out in the near future. The vast majority of the world will disregard GDPR and comply with their own local laws instead. Small and mid size sites from any given country are not going to attempt to comply with 407 different privacy laws from every country/city/state/region/zone/province/whatever around the world.
There is no alternative to this future. The sole, sane approach is to disregard Internet privacy laws if they do not apply to you in terms of jurisdiction. You will not be able to comply with the zillions of Internet-focused laws that are going to get created across the globe in the coming decade. GDPR should act as the training wheels for people building online sites/services/businesses to understand jurisdiction.
Even if you are independent and there's nothing the EU can realistically do to you, it's just one more thing you have to deal with. Figuring out WTF is going on, getting a lawyer to verify that there's nothing they can do to you, etc. etc. There are still some hard costs associated and it's going to distract you from what your company actually does for a while.
At the very least you still need a policy to give people telling them what data you keep and who you share it with. Even if that is nothing and no one, you need to be able to tell them that and you need someone who is responsible for handling those requests when they come in.
"Just don't keep anything" is not a sufficient answer.
No it's not. Stop spreading FUD.
If so, every part of every Internet-connected system on earth would be required to be completely redesigned to be GDPR-compliant. Demanding anything like that is not only unreasonable, it's 100% unrealistic.
The GDPR is perfectly reasonable legislation and has legroom for obvious operational requirements, like access logs.
(If you however mine the access log to derive or track users, that is another matter completely.)
So under GDPR you're not allowed to process data you've already got? I wouldn't call this reasonable legislation.
Furthermore, although IANAL, I suspect that certain classes of processing fall under different rules, therefore the processing could potentially be in violation even if the collection wasn't.
"I was just dumping data in logs, I don't have to care about privacy concerns. Oh, and now I have all this data on my server, since it's already here I surely deserve to process it without caring about privacy concerns!"
Might want to talk to a data protection officer before you go around swinging terms like FUD.
https://www.itgovernance.co.uk/data-protection-officer-dpo-u...
There is no exemption for small and medium-sized enterprises (SMEs), which has been reaffirmed by the Information Commissioner’s Office (ICO): "I've heard plenty of people talking about there being a DPO exemption for SMEs - this is absolutely not the case." Peter Brown, Senior Technology Officer, Information Commissioner's Office (ICO)
You need a DPO if:
* you are a public authority or body (except for courts acting in their judicial capacity)
* your core activities require large scale, regular and systematic monitoring of individuals (for example, online behaviour tracking)
* your core activities consist of large scale processing of special categories of data or data relating to criminal convictions and offences.
Imo, those are all pretty reasonable cases where you should have somebody responsible managing your data privacy. DPOs are for people managing very private data, or profiling people at very large scales. For most businesses, DPOs aren't relevant.
Even if you can avoid both of those you still need a point person who answers GDPR-related requests. Whether you end up calling that person the DPO (with the legal responsibilities and consequences that comes with) or just the "GDPR Guy" (also known as Ted from Accounting...) it's still something new you have to deal with, train for, etc.
That only applies if you illegally track users.
You know what a simple solution to that is? Yup: Don't illegally track users. Pure magic, I know!
It's simple arithmetic to decide it's cheaper to block all EU visitors.
They don't. They need to designate someone as the DPO, it doesn't have to be full time.
The DPO is a major imposition and simply being required to comply with the DPO parts alone is sufficient to make the EU not worthwhile for many businesses.
1. Whilst a DPO can theoretically be part time, a DPO is not allowed to have other roles in the firm that could create a "conflict of interest". This is so vague that in a company that works with data, almost any other role could be argued to create such a conflict of interest.
2. The DPO position has a list of mandatory responsibilities and even qualifications that will be accepted. For example the EU has advised DPOs need "expertise in EU data protection law". Where will foreign websites find such a person?
3. The DPO works for the firm but cannot be told how to do their job. They also cannot be fired or penalised for anything related to their job responsibilities.
In practice these rules mean it's very likely everyone will outsource the DPO role to third parties.
I think a large part of the scare that can be observed among American companies is due to legal advisers jumping on the opportunity to make big money by misleading their customers into thinking there are enormous, complicated and unlikely requirements for compliance, and huge risks to making any mistake.
The risk to making mistakes: fines of up to 4% of your turnover, in the worst case. As many companies have margins below this, it means losing all your profit for a year or more.
As for the rest, the vastness and vagueness of the GDPR has been extensively documented elsewhere. Bear in mind the EU Commission itself was immediately found in repeated violation of the GDPR just via their own website once the law activated. Their answer was that they themselves didn't have to comply with it.
* you are a public authority or body (except for courts acting in their judicial capacity)
* your core activities require large scale, regular and systematic monitoring of individuals (for example, online behaviour tracking)
* your core activities consist of large scale processing of special categories of data or data relating to criminal convictions and offences.
That's from https://ico.org.uk/for-organisations/guide-to-the-general-da..., which is a pretty good summary generally, from the UK Information Commissioner's Office.
If you're running an ad network building profiles of millions of users, then yes, you need a DPO. If you're storing extremely personal medical data, then yes, you need a DPO. If you're running an email newsletter, you 100% do not.
Given how US techies here on HN seems to constantly overreact and loudly proclaims how the GDPR means they need to hire 20 new employees and how they all will be suited into bankruptcy anyway...
If they are now stuck in a needlessly rigid legal regime, it's hard NOT to say they brought it on themselves.
The EU has no jurisdiction over newspapers in South Carolina. It is that simple legally.
If I visit a random popular Chinese site, landing on a Chinese mainland server in the process, the US Government is not going to get to tell that Chinese site how it can legally use my data in their country. Shouting that I'm an American citizen and that they must comply with US privacy laws, will do no good: the US Government has no jurisdiction over the matter. It works exactly the same way for the US-EU-GDPR as it pertains to a newspaper from South Carolina.
You might as well apply the same premise to US vs EU vs Chinese (vs any other country) freedom of speech laws.
It's the exact same jurisdiction premise on how rights are governed, whether we're talking about privacy or otherwise.
Just because I'm an American, that doesn't give me US freedom of speech protections when I step foot into EU countries or Brazil or China or North Korea. I'm bound by the local laws on most things, with few exceptions.
You seem to not understand that one of the core principles of the GDPR is that the EU intend to enforce it in all jurisdictions. Which they can do without an armed invasion using trade treaties, and instruments such as the New York Convention. For any entity anywhere in the world that doesn’t do business in the EU, blocking the entire union is the most risk averse and cost sensitive option.
The risk to local newspapers is low for now, but comes from the possibility of future agreements by the USA to cooperate with the EU on GDPR enforcement (e.g. as part of some trade deal), or their executives going to the EU for a business trip or holiday and coming under jurisdiction that way, or selling or wanting to be sold to a firm with EU presence, etc etc. Lots of ways the EU can end up with leverage over an apparently small and local firm.
Just like the US does not have the ability to dictate to China what privacy laws look like in that country or how US citizen data is managed within that country (eg when I visit a Chinese site).
How could any this possibly be difficult to understand?
If South Dakota comes up with its own crazy privacy laws, that doesn't mean it gets to actually "assert" how EU sites must manage data for people from South Dakota. It doesn't matter how much South Dakota screams about it, that state has no power to dictate anything to the EU. You would only have to particularly worry about it, as an EU site, if you were eg hosting a server in South Dakota, or doing business there.
edit: replying to your comment below, because my replies are throttled
It is in fact how jurisdiction works today and yesterday and always. The exceptions require agreed upon, established laws between the parties that say otherwise, which you just admitted is the case by referencing FATCA as an example.
Look at FATCA. A US law that every financial institution in Europe has to comply with whether they like it or not.
The EU knows it isn't going to invade the USA. Nonetheless, it has explicitly asserted many times that everyone, globally, is expected to comply, regardless of whether they have any EU corporate presence or not. Why do you think they would do that, if they aren't intending to find ways to make it enforceable? And there are certainly many tools available to do that with that aren't military in nature.
So you block access to your goods/services/website to EU IP addresses. Your suppliers and service providers are happy, your legal counsel is happy, and your business is not impacted in any meaningful way at all.
I haven't looked at the sites on the list, which may well contain "shady" websites, but bear in mind that these are the entities who have looked at the GDPR and concluded it was somehow or other better to expressly tell visitors that they do not comply with the GDPR.
A shady business wouldn't even bother putting a notice up on their website!
'Food Network' is one I've hit a few times searching for recipes; it seems several other domains are under its umbrella: https://www.foodnetwork.com/not-available.html
So either it's a political statement, or they somehow are subject to the GDPR, e.g. they are owned by a multi-national conglomerate, or sell data to them.
Even if they somehow figured out that they were already completely compliant (and ignoring the work involved in discovering that), there are policies and procedures you need to write to document who you share their data with and respond to requests from EU citizens about their data and the features to support answering those.
Again. Knee jerk internet reactions divorced from reality.
Access logs are not illegal under the GDPR. Stop spreading FUD.
You better inform yourself before making incorrect assertions
But it does get tiring, really
If only a fraction of their users come from the EU they don't need to deal with GDPR, they're exempt from it.
Edit: this is incorrect, see comment by guitarbill below.
> In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union.
it's far more likely they aren't "local" news stations, but owned by a multi-national, or selling data to multi-national corporations subject to GDPR.
You do not have to comply with GDPR if you are fully outside of the EU's jurisdiction and do no business in the EU.
Every site that gets created does not have to try to comply with every privacy law from every place on earth. At this point it's just belligerent propaganda to try to claim otherwise. It serves no good purpose to lie and pretend that every site on earth with EU visitors must comply with GDPR. That's a non-functioning future: all sites will not be able to comply with all privacy laws from all jurisdictions around the world. It's also legally unenforceable hogwash.
It goes even further however. As an EU citizen not only does GDPR not grant you any new protections in the US jurisdiction, you have very few privacy protections (none?) in the US. Sites with no business in the EU, those that aren't covered by the EU in any manner jurisdiction wise, can do nearly anything they want to with EU citizen data. Lawsuits can be filed against such sites, and they'll be promptly dismissed because the US isn't governed by EU law.
Another point is that the organisation would need some kind of legal presence in the EU, otherwise it would be impossible to prosecute them even if they did violate EU law.
That paragraph really doesn't say what you think it says. But like all such EU legislation it's really so vague that people who support the EU's political aims will read something anodyne into it, and people who are more suspicious will read something more dangerous, and they can both be right depending on the whims of the commission and ECJ.
However I will note that the EU does have an established track record of making surprising and totally unintuitive judgements about laws that appear to be much clearer and more definitive than what you just cited. The wording of the law is really not as reliable as you might hope with the ECJ.
As a side note, a lot of the comments here suggest that few people are reviewing the list at all before offering their opinion. Yes GDPR is a great step forward for data privacy, but there is little reason to shame "The Pueblo Chieftain" for not complying with GDPR. What is more likely:
1) compliance doesn't matter to them or their audience 2) they are trying to exploit and monetize your data
> but there is little reason to shame "The Pueblo Chieftain" for not complying with GDPR.
People are complaining about the corrupt business model of massive misuse of personal data.
The may have a parent company that does have an EU presence making the parent company liable in the event of a violation.
I went to a small local news site to read a story, I think it was for "Wales Online" and got presented with the options box. After clicking through to look at their advertising 'partners' my data could be sent to, I found a list of probably 200 different entities.
Presumably, for being a local news thing, this means that they have used some sort of advertising and analytics framework that plugs into some middleware system and from there passes out what it knows to these other places. I can't imagine each one is individually in the codebase.
What it exposed was the massive extent of what's going on. To access just a few hundred words of text, my details and activity would be passed on to an unbelievable array of companies. I'm very glad the GDPR has come in.
Right now ICOs can't even begin to hunt down all the small offenders, but once case law builds up and we have such a list bulk processes can be set up.
A browser extension could be used to ease reporting and even detect popular noncompliant solutions.
I have made a few sites GDPR-compliant, and honestly unless your business practices are based on exploiting people's data, it's not that hard.
It often comes down to advertising. No one (and I include Google and others in this) has properly figured out GDPR compliant advertising IMHO.
The effort of disabling ads for EU visitors is higher than just blocking EU visitors if you don't have a lot of resources.
The whole thing is simply about not collecting data you're not supposed to need in order to provide the service, and whatever you do it must be opt-in.
The only reason why a company needs to block a whole continent is that they've based their whole infrastructure on exploiting the user's data to such a level that they cannot provide their service without collecting and retain data they're not supposed to collect.
As for "a lot of resources", Instagram and the L.A. Times should have enough resources to become compliant.
* Sorry, this content is not available in your region.
* The precondition on the request for the URL / evaluated to false.
* Unfortunately, our website is currently unavailable in most European countries. We are engaged on the issue and committed to looking at options that support our full range of digital offerings to the EU market. "
* 451: Unavailable due to legal reasons
* Error code 16. This request was blocked by the security rules
* Apologies! The site you are trying to visit is not available in your area. Please note, to comply with GDPR we have purged our newsletter lists and databases for anyone located within the European Union. Thank you for your interest.
* 403 ERROR The request could not be satisfied.
* We're sorry you’re not able to access the site at this time, but this is a temporary measure to ensure we can best protect your data under new privacy regulations. We value your support; thanks for your patience and we can't wait to have you back!
I find it interesting that some present the problem as a technical problem whereas others explicitly mention a region problem or even GDPR
I also found a couple of places where the sites are in fact accessible, e.g. instapaper.com
The vast majority of the sites seem to be US local news sites, so perhaps to them providing access for EU citizens isn't really a key goal
That's even more weird since they are explicitly not covered by GDPR, because their target audience is obviously not based in the EU (and they most probably don't do any business in the EU either, so are completely out of reach as well).
It seems to me like they are the very websites for which this exemption was intended.
That doesn't help much when every US arm-chair lawyer (like the techies here on HN) spends all their time causing paranoia and telling everyone how even access logs are illegal now under GDPR, and how they will be brought into bankruptcy by the EU.
Ofcourse the business-people are going to panic when all they hear are their techies are telling them that EU is going to shut them down.
Whatever crappy legal regime these US techies will be stuck with in the future, one thing is certain: they brought it onto themselves.
That was mine!
What I find interesting is that they took the time to raise a location based 405, so they seem at least aware of it !
Fixed that for you.
The US Military News for example, probably won't need the tracking, as they have other intel and income sources, but they are also on the list. I suspect as a political statement.
But maybe note, that I am explaining the possible point of view for this side, not that I take this side. But since I got downvoted allready apparently, this was intellectually too hard for some to understand.
There's no excuse for larger players to not implement these rules. Many smaller players however, struggled and in some cases still struggle with this because some of the rules are rather vague (sometimes intentionally so in order to be future-proof) and hence open for interpretation.
There's the rub: While the law is clearly targeted at larger companies - to the extent some have called it Lex Facebook - it's the smaller companies and hobbyists, for whom implementing GDPR is more of a problem. I wouldn't be surprised if, in the long run, companies such as Facebook actually benefited from GDPR, at the expense of smaller competitors.
That is basically the end effect of any regulation: life gets harder for small players and newcomers.
I would offer the opinion that anti-monopoly regulation is a counterpoint to this.
However were i interested in US local news i'd be sad not to be able to access them.
From the websites point of view, i guess there's not enough money to be made from people located in the European union. They are certainly not targeting a global audience. In the end, they are free to choose.
I'm still hoping for the "Outline it" link right after the "web" one.
By not available what do you mean?
I currently block sites with annoying pop ups or show failure to comply.
The page you just linked literally says that. "One EFTA member, Switzerland, has not joined the EEA, but has a series of bilateral agreements with the EU which allow it also to participate in the internal market."
Switzerland is not under GDPR however, unfortunately many American sites assume EU = Europe. This is understandable because so many EU supporters insist on using the word "Europe" when what they actually mean is EU, in order to create this exact impression (and to confer on the EU the sense that it's as large and stable as a continent).
https://en.wikipedia.org/wiki/European_Free_Trade_Associatio...
> They adopt almost all EU legislation related to the single market, except laws on agriculture and fisheries.
https://blog.kpmg.ch/eu-data-protection-regulation-also-conc...
> When the Swiss Federal Council has engaged the Federal Department of Justice and Police to draft a revised DPA, which is expected by end of August 2016, it was the decision of the Swiss Federal Council to draft the revision in due consideration of the EU data protection regulation. The Swiss Federal Council also outlined, that it is economically important for Switzerland to be recognized as a country with an appropriate data protection level for the EU. Hence, the revised DPA is likely to be influenced by GDPR’s principles and will likely include largely analogical rules and provisions. According to the envisaged timeline, the revised DPA should be enacted around the same period as the GDPR, which is beginning of 2018.
Switzerland is for most intents and purposes in the EU, minus a delay of several years of applying the EU acquis (EU body of laws concerning countries part of the single market).
FTFY