Websites have been given a practical choice between annoying popups and blocking Europe.
It makes my life better when they block Europe, and I wish more did. I also wish Europe got rid of the GDPR.
It makes my life better when they block Europe, and I wish more did. I also wish Europe got rid of the GDPR.
The reality is, however, unless you have a major presence in the EU, or are the size of Google or Facebook... you can freely ignore the GDPR without consequence. EU laws do not apply across the ocean.
You don't need to be a legal expert to just not collect data you don't need.
The "technical resources" involved in identifying EU traffic is nearly always just a simple IP block list, where one can often just checkmark a list of countries in their web host's portal.
I think you grossly overestimate the technical prowess required to operate a website these days, and I think many grossly overestimate the actual real-world impact of GDPR outside the EU borders.
The reason why such "technical prowess" is needed is because businesses have made it more complicated than it needs to be. Keep in mind, the context of this conversation is the arrogance of literally claiming claiming you are being "censored" (because that's what the 451 response code indicates), just because you refuse to remove tracking analytics from your website.
The dude trying to sell custom T-Shirts has a website because it's a necessity to sell T-Shirts, not because he enjoys operating, optimizing and customizing websites. He just wants to sell more T-Shirts, and some European Union law isn't going to give him pause even for a second if he is physically not in a EU country.
While good intentioned, the GDPR was specifically designed to be a "viral" law and force the entire internet to comply... unfortunately the EU's long arm of the law is fairly short. Further, the EU's ability to enforce the GDPR is limited to businesses physically under it's jurisdiction - ie. the US is not going to extradite some website operator for an alleged GDPR violation, no matter how severe the case may be, and the EU can only fine a business into compliance if the business cares about EU laws (which would imply a physical presence in the EU).
Ignoring the GDPR is the right move for most websites.
If people desire comprehensive, impactful privacy guarantees, then a similar law needs to be passed within the US.
It is also more expensive to implement than
if(blocklist.contains(ip)) res.sendStatus(451)Just being able to receive such requests has costs, because GDPR requires that you have a contact in the Union that users can contact for such things.
So say you've got an online forum in California and some EU people join and participate. Whether or not that is enough to make you subject to GDPR depends on Article 3(2). There's lots of subjectiveness in Article 3(2) so it is not at all clear where the boundaries are.
If it does, then whether or not you have to have an in-Union representative is covered under Article 27. You do not need one if your processing of covered data is all of the following: (1) occasional, (2) does not fall under some special categories of data, (3) is unlikely to result in a "risk to the rights and freedoms of natural persons".
That's pretty fuzzy. What is occasional processing?
If you aren't sure that GDPR does not apply, or aren't sure that if it does your processing is occasional enough to fly under Article 27's radar, you need an Article 27 representative.
Eventually there will be rulings from EU data regulators that will make the boundaries of Article 3(2) clearer, so that you may be able to stay in "does not apply" without blocking. Or maybe rulings will clarify Article 27 so you will be able to confidently determine that your processing is occasional enough to not need a rep.
There's actually a lot of unclarity in GDPR. Take the data subject's right to have you delete their data. How do you actually implement that? Writing some scripts to delete from your database is probably not too hard.
But what about backups? Do you need to go through all your backup sets and delete their data from those? What about printed records (yes, GDPR covers printed data)? Offsite long term archives?
For a site like a forum, what about data that was in messages they posted that were quoted in messages from other users?
Until all these kind of things are cleared up by EU data regulator rulings it can make a lot of sense for a site that is aimed mainly at a non-EU audience to block EU users.
Meanwhile, GDPR is yet another disruptive annoyance to users, a burden on overworked, under-funded website teams and isn't delivering the benefits promised.
The GDPR provides a framework by which bad actors can do their thing legally without too much trouble. To a good actor, who only stores the data they actually need and doesn't track users, the GDPR still applies and is just as big a pain in the ass.
Users can now demand we delete their account and data and we have to do it, this is some work for us but it is good for users.
Also do you forget that popups were a thing before GDPR? Modal for you to subscribe to some shit,monthly Terms of Service changes, notifications to see what new feature was added, to see what new stuff some contact posted were a thing, with GDPR you get a one time popup , you make your choice and you should be done.
In summary
Pros for users:
- transparency, you now know about the 100+ partners and you can decide
- you can ask for your data and ask for it to be deleted
- you will get notified if your private data is lost(mioght be adifferent law for security breaches)
Cons:
- Shit websites use dark patterns and annoy you with a popup one time
No Pros for developers, companies: Cons for devs and companies:
- you need to research the law and find ways to screw the user with dark patterns
- you need to update some old project and remove tracking or implement some popup , implement account deletion, data demands etc
- you need to update your ToS documents, privacy policies
- almost never happens, you remove tracking or configure your ad script to don't track and you don't store private data.
From what I see users EU ones) have a lot to win, I assume if you are not in EU seeing the popup is a bug and would be fix .
It's only a burden on these people if they choose to be user-hostile.
There are really easy ways to deal with GDPR but these dumb companies insist on avoiding those solutions at all cost.
If companies insist on being dicks, then the only possible government-level solution might be to just ban this kind of tracking outright.
pretty sad that this is unthinkable.