Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR: US news sites unavailable to EU users over data protection rules

bbc.com

Post reply on HN
Print view View original

61–70 of 680 posts

Re: GDPR: US news sites unavailable to EU users over data protection rules

#61

Post by roel_v »

abcd_f wrote: post #21

What else can they do when they have this laundry list of tracking scripts on a front page: https://i.imgur.com/hKEItPS.png They obviously have NO idea what's being collected on every user and how it is being used.

Ironically, imgur shows a wholly non-compliant 'when you click yes here, you agree to all our default opt-in tracking, storing and sharing' popup when you open that link. But I have to give it to them - when you actually go into the scary-looking part, they do spell out in detail in what ways you're being tracked.

Re: GDPR: US news sites unavailable to EU users over data protection rules

#62

Post by chatmasta »

I'm in the UK atm. I just took a look at CNN.com, and uBlock is still blocking dozens of trackers there. I disabled it to see if I would get a GDPR consent popup, but all I saw was an accept cookies notification, nothing about the dozens of third party trackers on the site, other than some sparse information. There is no way to opt out of them, and there is only an “I accept” option on the accept cookies box. So CNN is not GDPR compliant, even though they've been running stories about it recently?

Re: GDPR: US news sites unavailable to EU users over data protection rules

#63

Post by qz3 »

tzfld wrote: post #53
flohofwoe wrote: post #48

Alternatively there's this: https://eu.usatoday.com/ No ads, no tracking, no cookies, not even Javascript. Just plain HTML+CSS and JPEG images. The whole front page is around 650 KByte, and by far most of this is in the image files. As a result the page looks very clean and loads very fast. This is what all news web sites should look like, not just for EU readers (although I fear that this is just a temporary solutio…

And how can be a business sustainable in this way?

And how can be a business sustainable in this way?

By not building their entire business around ads and tracking.

Re: GDPR: US news sites unavailable to EU users over data protection rules

#64

Post by _Codemonkeyism »

icebraining wrote: post #46
simion314 wrote: post #30

Earlier quoted context omitted.

For a site that shows text and images you have a simple solution change the code if(isUserInEU()) showBlobkingPopup();) else loadAllTrackingScripts(); into if(isUserInEU()) loadNonTrackingScripts(); else loadAllTrackingScripts();

The problem is ads. Many networks track their users, and the site is responsible for that too. Eliminating all ads means the EU users become only a cost. They need to integrate GDPR-compliant ad networks to serve to EU users, and they probably didn't do the work.

There is no need to eliminate all ads. You need consent for the apps though.

"GDPR is very pragmatic on this point: whatever is really necessary for an app is legal without consent, the rest needs a free 'yes' or 'no' option."

http://www.bbc.com/news/technology-44252327

Re: GDPR: US news sites unavailable to EU users over data protection rules

#65

Post by scbrg »

jannes wrote: post #4

I won't miss them. Why would I need to know about local news from places over 5000 km away? Luckily there is still archive.is and the Internet Archive for exceptional articles that pop up on HN.

That's an surprisingly unimaginative viewpoint. Off the top of my head:

  - You have friends/family in that area
  - You actually live in that area, but you are currently travelling
  - You are considering visiting the area
  - You are doing some kind of research about the area, say, how often a certain type of crime is reported in local media
I'm sure the list can be made much, much longer if we spend some time thinking about it...

Re: GDPR: US news sites unavailable to EU users over data protection rules

#66

Post by _Codemonkeyism »

vntok wrote: post #34
_Codemonkeyism wrote: post #25

Earlier quoted context omitted.

IANAL but after working on GDPR topics for months with a lot of reading I'd say they would work. Selling data is still hard to argue, I'd not do that for EU citizens ("tag EU citizens to opt out from selling data"). Everything else should be possible. Using Art 6/1(a) and Art. 7 GDPR you can store most of the data from your visitor. You need to make sure they can inform them about your usage, revoke their aggreement…

"Clever UI" (read: deceptive) tricks are obviously explicitely forbidden by the GDPR.

No, not a dark pattern, like LinkedIn, just a "yes" & "no", but if you place "yes" to the right side people will more likely click on "yes". If you space them at the bottom of the EULA, "no" to the left border, "yes" to the right border more people will click on "yes".

This is not something I would do, but my salary is not coming from placing ads on a site and selling personal data. But this is what will happen.

Re: GDPR: US news sites unavailable to EU users over data protection rules

#68

Post by _Codemonkeyism »

icebraining wrote: post #40
_Codemonkeyism wrote: post #26

Earlier quoted context omitted.

IANAL No, coupling is forbidden. A 20 page, non-legalese EULA is allowed if you don't couple acceptance to using your site. "You need to individually opt-in to every single use case" No. But I would be happy for your source on that. You can't change the usage purpose after collecting, but if you declare what you do before (20 pages EULA) data collection, you're fine. "and you need to consent to every transfer to each…

I would be happy for your source on that. It's in the "Guidelines for Consent" document, in "3.1.3 Granularity": "A service may involve multiple processing operations for more than one purpose. In such cases, the data subjects should be free to choose which purpose they accept, rather than having to consent to a bundle of processing purposes." And they give an example: "Within the same consent request a retailer asks…

Thanks!

Re: GDPR: US news sites unavailable to EU users over data protection rules

#69

Post by _Codemonkeyism »

IshKebab wrote: post #47
akie wrote: post #23

Earlier quoted context omitted.

"Click here to agree to everything we do" schemes are explicitly forbidden by the GDPR. You need to individually opt-in to every single use case, and you need to consent to every transfer to each individual third party as well.

And yet, that seems to be the solution most sites are already taking. "Click here to agree to tracking and continue to our site." Concrete example: theverge.com Hopefully they will be slapped down for it pretty soon.

The way "theverge.com" does is clearly not compliant, because they track/store IP/... before I give consent. I also can surf without consent.

Re: GDPR: US news sites unavailable to EU users over data protection rules

#70

Post by roel_v »

ghaff wrote: post #31
imdutch wrote: post #19

Earlier quoted context omitted.

You can still run a free website and be compliant with the GDPR. The EU/EEA is the largest market in the world, closing yourself for an market that size will hurt more than changing a few thing to be compliant.

>closing yourself for an market that size will hurt more than changing a few thing to be compliant Only if I make significant money from that market. If most of my revenue/profit comes from the US and it's problematic to "do business" in the EU or China, why wouldn't I want to just cut access off rather than dealing with potential hassles? The fact that it's potentially a large market is irrelevant to me. In this cas…

I see this 'VPN' argument a lot, but it's wrong. If the Chicago Tribune tracks users accessing their site through a VPN, without informed consent, they are in violation. Art 3 para 2 in b makes the Regulation apply to them and doesn't make provisions about whether the controller or processor has a way to find out if the behaviour of the data subject takes place within the Union. I don't see any reason for a different interpretation in the Recitals, either. Furthermore note that subs a and b in art 3 para 2 are alternative, not cumulative requirements.

Let me rephrase: when you collect data on people with the goal to do behavioral / preference analysis on it, it doesn't matter any more whether or not you're 'marketing' to them, or even that you 'send them a clear message' you don't 'market to them'. The GDPR still applies to you.

Post reply on HN