I always thought Gibson's concept of "data havens" was kind of silly; data doesn't care where it lives, why would it matter where it's physically located? But apparently he was a bit more prescient than I originally gave him credit for.
Because consumers and advertising partners want to pay in the local currency, using local means of payment, which are often only available with a business bank account available only to locally registered businesses.
And then things like salespeople on the ground who can visit advertisers' offices, go to conventions, etc.
If you want to actually be a viable business in a particular country at a large scale, it often becomes impossible to avoid having to incorporate there and hire people locally, even if your actual product is entirely digital.
It's much easier to block local advertisers' money going to such companies.
If you block X, you block obviously ads, but you also block local traffic to the website.
If you just block ads, and the traffic continues, you are actually losing even more money.
Sure, Musk could just implement crypto on X, but I think it would still be very effective.
Also the company could be asked to forbid EU customer to access the product. Wouldn’t be a big threat but it would prevent the company to do any futur business in Europe.
Tech savvy customer could still access the product but that is not a market as big as every EU potential customer.
BTW what's your take on US requiring US-based companies to provide data on foreign citizens if subpoenaed?
The debate is not whether the US will do something draconian the EU is doing today.
BTW remind me what's your take on the US banning Huawei in the US?
E.g. here's Facebook's report: https://transparency.meta.com/reports/government-data-reques...
In July-January 2023 they received FISA requests targeting over 150 thousand foreign nationals
And generally, it came with a slap of the wrist, and the company put up the banner.
For a site to be blocked, it need repeatable, multiple and not correctibles infractions.
If you're in a hypothetical country that the EU has no relevant treaties with, the EU has no power over you. They might claim that EU laws are extraterritorial and affect everybody who dares to appear on the internet without blocking EU citizens, but that claim can't be enforced in such a country.
Most countries have their own, but they're mostly for copyright infringement, not GDPR violations.
Even that isn't universal, Poland's system only affects unregistered gambling websites for example, and I've seen quite a few ISPs that don't even bother enforcing it, even though they're legally supposed to do so.
There's nothing (except talking to your government) that the EU could realistically do at this time to block a website, and I genuinely don't know how receptive the US would be to these arguments.
The largest "hook" the EU has is that most companies that provide services to you, whether that'd be payment processors, hosting services or ad networks, (still) want to maintain good relations with them and don't want to burn bridges, and I don't believe it's beneath the European commission to put pressure on those to make your life difficult.
If you take direct payments, you'll probably have a talk to your card acquirer on how they feel about EU clients and how you deal with them. They might decide to not do any business with you depending on that.
In these above examples, I think having wider scale actually helps negotiating better terms instead of getting kicked out at the first occasion.
When Steven Harper unilaterally attempted to empower private data to be offshored, it would have been an absolute nightmare.
North American security is bad enough as it is. Imagine handing all your health, credit card, government information over to a Nigerian prince just for free.
Do you have any source for that ? it would n’a quite helpful, honestly.
It’s not quite data sovereignty like India’s regulations around payment transaction data but it does theoretically limit where you can store EU personal data.
You can find the current GDPR adequacy list at the EU’s EDPB site. https://commission.europa.eu/law/law-topic/data-protection/i...
Source: GDPR articles 44, 45, and 46.
Modern services, including Twitter, have the ability to geofence content/compliance policy to specific regions. Search, Social Media, Maps and News are examples of typical services which engage such techniques. So there's not a lot of reason why Twitter couldn't comply here, since they already have already demonstrated this capability.
Twitter's non-compliance will likely just end up with a ban.
It's not like fat-->skinny-->fat-->skinny ties, where there's zero friction for the pendulum.
The only way the net is going back to the old ways is if the governments of the world stop caring (good luck with that) or if end-user decentralization tools make a quantum leap in adoption, but even then I think you're more likely to see governments cracking down on that rather than just not caring.