GDPR: US news sites unavailable to EU users over data protection rules

There are so many wrong things with this approach. First, what do you do when you have existing users, delete them? Second, I believe the law protects EU citizens regardless of where they are. If you're an EU citizen and register for a service somewhere in the US using VPN or while physically being outside the EU, that service/company will still need to comply. The safest approach is to comply. We're a tiny startup, but we decided to bite the bullet and comply because its much easier and quite frankly better for all in the long run. Oh and, disclosure sets you free.

I'm in the EU, and a couple of the corporate VPNs I have used here have had their exit IP in the U.S. or Canada. Which means that when I'm at work, I appear to be in Seattle, and these sites are not blocked.

Based just on that, I'd argue that "Blocking 500M Users Easier Than Complying with GDPR" is probably not even a true statement.

I doubt EU regulators will go after these sites because they really aren't that consequential, but I wonder if setting up an IP block isn't just painting a target on yourself. It's basically a statement that the company was and still is violating GDPR.

They claim that everyone had a lot of time, but what about the 1-3 person startup that’s been around for 4-5 years who is just getting by and didn’t have the resources to re-engineer their entire application or to write up a complex privacy policy or hire an EU Representative (Yes, apparently that is required as well). If the EU does clamp down on forced consent I think the long tail of small startups and publications and side projects will simply block EU visitors because they won’t have the means to become compliant.

I’d be interested to hear how problematic this is for new startups who are building GDPR complianance into the systems from scratch. It would seem to amount to needed bespoke permissioning for every user because forced consent is not permitted (although being widely used).

Business don't comply with regulations because it is easy, but because it's needed to do business.

If a service didn't had a big user base in Europe, most countries don't speak English, it may be cheaper to remove the service.

The New York Times or The New Yorker that even have physical copies available in Europe work as usual.

I work in a gambling company and this is our day to day business. To enter a new market means to follow a new set of regulations. To do the adaptation or not is an strategic decision based in complexity, expected revenue and other factors. GDPR is just another regulation to add to the long list related to tax evasion, responsible gambling, fair play, etc.