21–30 of 80 posts
If I was starting a startup today. I'd probably just block Europe and focus on other markets initially. Loop back on Europe once you have product market fit and the resources to deal with GDPR.
This means that sending data from the EU to a US company is almost always a GDPR violation. There are a few nuances to this which are very important.
- The US CLOUD Act gives US law enforcement access to data stored in other jurisdictions. This means that locating the servers in the EU is not sufficient. Nor is operating via an EU subsidiaries.
- IP address counts as personal data, as does pseudonymized identifiers.
The two of these combined mean that GDPR forbids you from having your users connect to Google servers. This is why Google Fonts is straight forbidden, and why most installations of Google Analytics are forbidden. Also the use of basically anything from Google, Azure, AWS, Oracle, Facebook, Akamai, etc except when routed through an EU proxy which obscures the user's original IP address.
You can find many, many of them when you search Twitter for "buildinpublic".
The sad truth is that most successful solo founders these days:
1) Make it very hard to figure out where the service they provide is located.
2) When you find out, it is usually registered in a country outside of the EU. Crunchbase often helps to find the location.
Apart from the USA, Singapore and Colombia seem to be popular choices among solo founders who know what they do:
https://www.crunchbase.com/organization/nomad-list
https://openstartup.tm/remote%20ok
What the discussion about GDPR usually misses is that GDPR does not only apply to Google Analytics and Google Fonts.
A web business needs a hosting solution, a CDN, a payment processor, an email solution, an A/B testing solution, etc etc etc.
If you try to handle all that inside of the EU, you are cut off from all the good tools that startups usually use.
Someone should build GDPR-compliance-as-a-service.
How about "Don't use Google Analytics and Google Fonts"? Like, at all ? There are self-hosted alternatives. Plausible Analytics is good. Find web fonts that you can host yourself. Not only you will reduce your risk exposure, you'll see that it is not that difficult to get rid of Google. Your users, European or not, will thank you later.
Although you're right, there are alternatives to Google Analytics, you really should work on your messaging. Snark isn't necessary when someone is (seemingly) genuinely asking for help. In any case, for the OP I would also recommend to use an alternative. I don't know about Plausible Analytics but I have heard good things about Simple Analytics [1]. I'm not sure about Google Fonts. In terms of GDPR compliance, just k…
It's the same thing with the cookie-banner law, by the way. I am running a service in Europe and I can proudly say that I have no cookie banner on my site. You know why? Because I don't have any tracking cookies on my site in the first place.
Court rulings in the EU have found that US law is not compatible with GDPR: US lets law enforcement have unfettered access to the data of EU residents, with no restrictions or redress mechanisms that satisfy the EU court. This means that sending data from the EU to a US company is almost always a GDPR violation. There are a few nuances to this which are very important. - The US CLOUD Act gives US law enforcement acce…
Earlier quoted context omitted.
I don't see a difference with fonts.bunny.net and Google Fonts? From the perspective of GDPR, they still both receive your IPA and browser info, which was what made it illegal to use G fonts. You can download fonts from both of them and host them on your own server to avoid processing that information. I'm all for privacy and such (I don't use Google Fonts or tracking ads/analytics), but I don't really see a differen…
> According to G Fonts privacy policy, they don't store any PII. Do they log IP addresses? That would be enough as those count as PII. Maybe bunny.net has logs disabled and that's what makes them stand out. But especially with fonts it's just so easy to self-host them that it's kind of a no-brainer. > almost any 3rd party requests for assets should be blocked That could be a very good practice/state of mind for devel…
There's zero benefit to using a CDN for fonts - browsers have long ago started partitioning caches per origin anyway, so you don't even get a performance benefit. Just put the fonts where you put the rest of your static files and you're good to go.
As a small, bootstrapped one person startup, the part of GDPR that seems impossible for me to comply with (I am not lawyer nor am I European, so maybe I am wrong, but everything I have read about it indicates I am right) is the appointment of a Data Protection Officer. I do the duties of the DPO myself, but from what I have read, this is not in compliance with GDPR, which requires the DPO to be "independent". See htt…
Got a relevant question myself: What bothers me the most for solo founders with GDPR is that you can't analyse individual user journeys without some kind of consent. I don't care who you are, but I care how you use my product so I can improve it. Aggregated / backend analytics will give me only the most basic insights. Am I right in that? Is it possible to work around that? I don't track to sell or analyse personal d…
IANAL, but I think you can work around this by running Matomo locally and activate the options to anonymize/scramble IPs directly at the beginning. If you don't use IP addresses or can't come back from a user profile to an IP address, you should be fine with tracking the user journey. But be careful with tracking actions like "placed an order" and linking to that order then. That link would create an option to identi…
The only analytics you can do without consent is effectively a stateless hit counter that increases on every operation. For a lot of features, it's more than enough and saves you from all these headaches.
How about "Don't use Google Analytics and Google Fonts"? Like, at all ? There are self-hosted alternatives. Plausible Analytics is good. Find web fonts that you can host yourself. Not only you will reduce your risk exposure, you'll see that it is not that difficult to get rid of Google. Your users, European or not, will thank you later.