Hacker News Reader

Comment by mxstbr | Hacker News Reader

“Unfortunately, our website is currently unavailable in most European countries. We are engaged on the issue and committed to looking at options that support our full range of digital offerings to the EU market. We continue to identify technical compliance solutions that will provide all readers with our award-winning journalism.”

Yeah I can really see how that impacts Fred Rogers /s

How hard can it be to build a publishing website in a privacy-respecting manner? It's been a while since GDPR was introduced.

View on HN

> How hard can it be to build a publishing website in a privacy-respecting manner? It's been a while since GDPR was introduced.

I can understand why a newspaper whose subscriber base is in southern California would not want to spend the time and money necessary to comply with European privacy regulations. It's unlikely that the benefits for the business would outweigh the costs.

I suppose the implicit question is more; what are they doing that is likely to be in violation of some (relatively mundane, tbf) privacy regulations.

The only thing gdpr really changed was the size of the fine...

Using a cookie for non-essential functionality would be enough.

> what are they doing that is likely to be in violation of some (relatively mundane, tbf) privacy regulations.

Why should they even bother spending resources understanding those regulations?

The decision is pretty straightforward for them. Don't like it? Go complain with the regulators.

Uh, obvious reasons? The fact that they block EU visitors might not hurt them, but the fact that those people complain on sites used by US visitors will.

> will

Nah, people whinning on hackernews is pretty much irrelevant.

> It's unlikely that the benefits for the business would outweigh the costs.

On the Internet, nobody cares where you are located. The fact that one cannot be bothered to serve their bytes, at basically marginal networking costs (and some fixed one-time investment) to hundreds of millions of potential additional readers shows bad business judgement and poor leadership.

> The fact that one cannot be bothered to serve their bytes, at basically marginal network cost (and some fixed one-time investment) to hundreds of millions of potential additional readers shows bad business judgement and poor leadership.

The LA Times makes money from subscriptions. How many EU citizens do you think would purchase LA Times subscriptions if the site complied with the GDPR?

Subscriptions is the end-result. To get there you need many things: brand, reputation, good crawling, incoming links from authoritative sites. All of these are predicated on the idea of a global Internet.

If webmasters in Europe stop linking to you, Americans traveling in EU lose your trust, and EU-hosted search engine crawlers figure you don't exist, then you start to have some problems.

A good businessman is able to change its assumptions when the world around him changes. In 1980, it might have made sense to limit your newspaper audience in the area where you lived. In 2010+, due to the Internet, the main cost of a newspaper consists in the work performed by the writer to produce the actual content. When the world around you gives you basically free infrastructure to send those bytes to another continent against a one-time investment of assessing and fixing your site for compliance, you just don't say no.

Assuming what you say is true, would one expect prominent newspaper websites that are GDPR-compliant and accessible from the EU to be doing better financially than prominent newspaper websites that aren't? Is that the case?

That's a good question. But is that data even available, especially in the format that would allow to tease out how much each aspect of the enterprise contributed to the financial situation?

As an addition to the GP's argument, consider that these days, news stories are meant to be linked to on social media. People have friends and audiences in many places in the world. If someone with parts of their audience in Europe wants to share a news story, will they choose an article on GDPR-blocking site, or on a GDPR-compliant one?

Not necessarily, since complying would likely yield only like 2% (number made up) extra returns on whatever their revenue already is.

The most important factor is still if your newspaper is any good.

> On the Internet, nobody cares where you are located.

The EU cares.

I don't think EU will be special in the grand scheme of things. US legislation is already pending under draft form ( https://www.reuters.com/article/us-usa-internet-privacy/pris... ).

To rephrase: if you produce an asset that can be shared with an additional significant audience at a fraction of its production cost, and all you need to do is a one-time compliance cost that probably will soon become mandatory for your primary area of distribution, then how can it be a good practice to continue banning your customer-base based on what continent are they in the world?

If sharing won't generate enough revenue to pay for the cost, why would you?

You can't have the cake and eat it too. You can't pass regulations and then complain people don't want to do business with you.

> If sharing won't generate enough revenue to pay for the cost, why would you?

Any one-time cost can be amortized in time by recurring revenues, after which you're left with pure profit.

Technical work (manage your reader's cookie and policy preferences etc) is a one-time cost. Revenue from EU readers is an ongoing benefit. Hence, as long as EU income is greater than its traffic serving costs, you're bound to come ahead after some amortization time.

1. There is a time value of money so if those costs are high enough, the meager returns can be less than they can get elsewhere and thus they shouldn't do it.

2. There are other ongoing costs to comply with gdpr outside of the server fees such as manpower to comply with gdpr requests, lawyer fees if they get sued and obviously fines if they lose any lawsuit related to it.

The fact that the LA Times is not doing is enough evidence that it isn't financially viable for them.

I'm going to present an unpopular opinion: Why should they?

I'm all for a free & open internet but I'm not for the internet complying to regulations set by governing bodies that do not represent the entire globe.

I believe that if a government should choose to attempt to regulate and enforce what we can build online and how then they (and their constituents) should be dealt with in a hostile manner.

And this from the fourth largest newspaper in the entire US and the largest newspaper of the second largest city, no less.

I just in Europe last week and it was infuriating how many US-based newspapers couldn't even be loaded. Americans travel abroad, and foreigners read domestic news sources. The LA Times isn't just local news; it's cited widely in, say, Wikipedia articles, and those are read globally. So to refuse to display any content in Europe is a huge middle finger.

Do you believe LA Times misjudged their cost-benefit analysis of EU publication?

Or do you think a cost-benefit is the wrong approach?

Both.

The cost to providing a minimal EU only view (using the inverse of the current "should I block" function) that complies with the GDPR should be near 0.

The benefit, both in terms of advertising revenue, and network affects driving more non-EU viewers, should be high.

It's not plausible to me that an accurate cost-benefit analysis says "don't publish to the EU".

Separately, as journalists I expect them to be willing to spend some amount of effort (and it shouldn't take much) to report as widely as possible, even if a strict cost-benefit analysis suggests they shouldn't.

The fact that they aren't willing to do this brings their motivation, and thus their integrity, into question.

What do they do when some EU citizen decides to sue to be forgotten for some misdeed?

A big newspaper has a target on its back for GDPR trouble, and they have enough trouble already. Blocking access is the pragmatic answer — most other organizations are just ignoring it.

> Separately, as journalists I expect them to be willing to spend some amount of effort (and it shouldn't take much) to report as widely as possible, even if a strict cost-benefit analysis suggests they shouldn't.

> The fact that they aren't willing to do this brings their motivation, and thus their integrity, into question.

Newspapers are businesses. If they don't make enough money they will have to close down, and then nobody gets to read their journalism anymore. So cost-benefit analyses cannot be avoided.

TorGuard or NordVPN

I country switch quite a lot these days. Video won't load? pick the Canadian VPN. Website won't load from Europe? use the New York VPN. The crypto exchange doesn't accept US customers? Use the Iceland VPN. Netflix pretends not to have a show anymore? Use the Australia VPN.

There was a time when I thought this would be a ridiculous suggestion, but at this point the VPN software is very convenient and they have such a wide array of servers in different countries, and regulations make the net much more fragmented. It is second nature for me now.

huge middle finger the americans traveling abroad demographic? daffaq?

I want to see a PO justify resources for that epic. lol

> How hard can it be to build a publishing website in a privacy-respecting manner? It's been a while since GDPR was introduced.

Why should they even bother?

Especially for a regional newspaper.

To make money? I mean, they can choose to do that in whatever way they like, their decision to lock out such a huge market just seems odd.

They’re a local paper. They cover 100% of their market already.

> To make money?

The fact that they aren't doing it is a god signal that those users aren't worth the cost.

You can't pass regulation and then complain that companies don't want to do business with you.

So why should they?

At least they're blocking out of a fear of litigation. They'll figure it out eventually. In contrast, the BBC blocks a lot content from international viewing just because they're cheap.

The BBC has a charter that mandates they serve the people of Britain. Its implementation is complex, but overall it is necessary to allow for more than just market forces.

I use outline.com to get past these attempts to block the EU:

https://outline.com/BF9AaC

It almost always works. As does archive.is, if you want to see more of the page's original layout.

I'm curious: So what you're saying is that you don't value the ideas put forth in the GDPR, because you want the content so badly that you'll bypass a block based upon it? Because if so, it totally validates their decision to not spend resources on it.

Copyright issues aside, my impression is that this solution is mostly in the spirit of GDPR. LA Times doesn't want to take the legal risk of being accidentally non-compliant (or doesn't want to go through the effort just yet), and outline.com is willing to act as a "wrapper website" that serves LA Times content while also following all EU rules around cookies. That means people in the EU are able to access the content without losing any privacy rights around cookies.

But you're right that it does validate the LA Times's decision to not spend resources on it, if there's an easy way to offload the legal worry to another company.

I don't see what "legal worry" there could be if they're not abusing personal data. They could provide a plain-text website (even with ads, since the providers are probably all doing business in the EU) or link to outline.com, which would at least gain them the reputation of somebody having read a good article from them.

Well said. You've elucidated my thinking better than I could.

Another aspect: I've set up my browser to be pretty aggressive about blocking ads & trackers, to the extent that in practice any website is limited to tracking only what they can collect server-side, with first-party isolation; as such, GDPR doesn't give me that much extra protection when I'm interacting with sites that I'm not actively giving my personal details to.

I'd still appreciate the additional protections GDPR provides, in terms of control over that server-side tracking, and when interacting with sites that do know who I am; and I see the value in even the protections I don't personally benefit from, for the sake of people who aren't tech-savvy enough to lock down their browsers to the same extent (and to deal with it breaking sites, when that happens). So I'm still a fan of GDPR in general - it's just that, when it comes to me personally, just passively browsing a site, my own browser set-up is adequate for my liking.

Isn't this copyright violation? Or do the websites have a deal with the site?

> Isn't this copyright violation?

Eh... maybe? I mean, you could achieve the same end result with a proxy/VPN and your browser's reader mode - to do it that way wouldn't be copyright infringement, would it? I feel like, in principle, Outline should be treated the same.

But on the other hand, the fact that they're transforming the page server-side, and caching it there, may push it over the line in the eyes of the law. IANAL, I don't really know.

To be honest, copyright law is such a tangled mess, I don't really give it much thought. Outline does the job, and if anyone's going to get into trouble it'll be them not me, so I'm happy enough.

Right. It's definitely them violating copyright since they're distributing. Imagine if I just copied all your blog posts and put it on a different site with my advertisements on it. That's copyright infringement too. This is no different.

They will probably be auto-DMCA'd soon.

Reply on news.ycombinator.com