> A German CDN can setup their own infrastructure
Ok, but what if you just want to run a website and not build a billion doller global CDN.
> GeoDNS
According to the GDPR you have to protect the data of your visitors no matter where they are.
Ok, but what if you just want to run a website and not build a billion doller global CDN.
> GeoDNS
According to the GDPR you have to protect the data of your visitors no matter where they are.
Ah, from the perspective of website owners, not the CDN owner... Well, use a European CDN, they tend to follow European regulation, just like US companies follow US regulation. The two companies that comes first to mind is BunnyCDN and KeyCDN, but I'm sure there are many others. Both of them have global networks.
> According to the GDPR you have to protect the data of your visitors no matter where they are.
Yes, of course, that's the ground truth we're assuming here. Is that some sort of gotcha? I'm not sure I'm understanding if you're arguing against what I said or just adding information on top without disagreeing.
> Even if you run an extra host like www.yourdomain.de for Germans, they could still type www.yourdomain.com into their browser and this alone would cause tcp packets to flow from their machin to CloudFront. There is no way to avoid this.
If you're adamant on running US infrastructure for US users and EU infrastructure for EU users, you can do that by using GeoDNS/Regional Records.
But personally I find it easier to treat everyone as a EU user, and I store no personally identifiable information what so ever except information given by users themselves (like emails for registration), so maximum privacy for my users.
Edit: in order to make this discussion a bit more fact based, as some misinformation is starting to leak into it: I'm referring to Article 3 from GDPR, "Territorial scope". It states:
> This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union
They are not, where are you getting this from?
Again, Article 3 from GDPR, "Territorial scope";
> This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union
data subjects who are in the Union
Merry Christmas to those two.
The recent rulings say that no packets are allowed to travel to the US because that would enable the US government to access them if it wants to. I don't see how this can be avoided. As soon as a tcp packet enters the US, it is on infrastructure the US government can access if it wants to.