Hacker News Reader

He's likely subject to California law, though. California residents might get a different answer to such a request.

https://oag.ca.gov/privacy/ccpa

> Right to delete: You can request that businesses delete personal information they collected from you and tell their service providers to do the same, subject to certain exceptions (such as if the business is legally required to keep the information).

View on HN

Yes, this is how legal jurisdictions work. He can receive one request from someone in Mississippi, one from someone in California, and one from someone in the EU, and provide three completely different responses.

Yes, but he doesn't have to.

One of my clients willingly applies GDPR to everyone, regardless of jurisdiction. If you want your data, you can get it. If you want your stuff deleted, you can do so. I think this is the ethical approach.

It is also, from what I know, the legal approach. The EU perhaps doesn't have jurisdiction over a service, but what they can do is ask all the ISPs in Europe to block access to it, for example.

Reply on news.ycombinator.com