How does CloudFlare know if someone is a citizen of the EU and traveling abroad? In haproxy, I redirect a few accept-language headers, but even this has its faults.
GDPR for lazy people: Block all European users with Cloudflare Workers
11–20 of 1001 posts
Re: GDPR for lazy people: Block all European users with Cloudflare Workers
#12Considered this before, but it doesnt work. IIRC, the law applies to euro citizens both living in country and abroad. As such, geoip blocking is not a working strategy. (a french citizen who lives in japan still had GDPR rights) A better one would likely be a clickwrap agreement for all users stating "European citizens are not allowed on this service" which they have to click a "I am not european" tickbox to.
nah the law doesn't mention citizenship. it applies for "every user In the Union" and for all companies in the union.
Re: GDPR for lazy people: Block all European users with Cloudflare Workers
#13How does CloudFlare know if someone is a citizen of the EU and traveling abroad? In haproxy, I redirect a few accept-language headers, but even this has its faults.
You're the third person to ask this and I'd like to ask you: is this idea coming from a specific source? The law, like any other EU law, obviously does not apply outside the EU. It applies to companies that do business in the EU (even if they are based outside), but it can't apply to companies that don't do business there. https://ec.europa.eu/info/law/law-topic/data-protection/refo...
Re: GDPR for lazy people: Block all European users with Cloudflare Workers
#14I think the most important part about the post is at the very end: > Please don’t take us seriously > This is an example of all the things you can do with Cloudflare Workes and our API. If you like it, please spread the word! But hey, don’t take us seriously. We just wanted to take the drama out from all the GDPR madness out there. Anyway: just for academic interest I’m curious how much this increases the overall req…
You can see the average latency here: https://status.apility.io
But Cloudflare has servers very close to our endpoints around the world, so I guess We are working hard to reduce the amount of time to establish the connection. It's about 80% of the time of the request.
Re: GDPR for lazy people: Block all European users with Cloudflare Workers
#15Considered this before, but it doesnt work. IIRC, the law applies to euro citizens both living in country and abroad. As such, geoip blocking is not a working strategy. (a french citizen who lives in japan still had GDPR rights) A better one would likely be a clickwrap agreement for all users stating "European citizens are not allowed on this service" which they have to click a "I am not european" tickbox to.
I'm the author of the post, and yes: blocking 500 million geolocated people is crazy. That's not the spirit of the law. I just wrote the post because if you want to overkill and you are lazy, you can follow our recipe to 'implement' GDPR. I just wanted to be sarcastic and also show how easy to implement Cloudworkers + Apility.io.
You should consider making this a bit clearer in the beginning. There is already a lot confusion about GDPR lately and people could take your post seriously. As pointed out by others already, geo-blocking isn’t a proper way to become GDPR compliant.
Re: GDPR for lazy people: Block all European users with Cloudflare Workers
#16How this checks if a user is European when using US VPN or being on holidays outside EU?
It doesn't. It just checks that somebody is connecting from an IP address geolocated in Europe.
I tried to be sarcastic, but I think my English is not good enough :-)
Re: GDPR for lazy people: Block all European users with Cloudflare Workers
#17How this checks if a user is European when using US VPN or being on holidays outside EU?
It uses its magic crystal ball, while simultaneously consulting a legion of captive demons to determine this and other similarly unknowable information.
Re: GDPR for lazy people: Block all European users with Cloudflare Workers
#18How does CloudFlare know if someone is a citizen of the EU and traveling abroad? In haproxy, I redirect a few accept-language headers, but even this has its faults.
You're the third person to ask this and I'd like to ask you: is this idea coming from a specific source? The law, like any other EU law, obviously does not apply outside the EU. It applies to companies that do business in the EU (even if they are based outside), but it can't apply to companies that don't do business there. https://ec.europa.eu/info/law/law-topic/data-protection/refo...
It actually isn't clear that it doesn't, as best I can tell. I don't have the text in question in front of me, but one of the questions I've asked and haven't gotten a solid answer on is - who is covered by GDPR? Is it only EU citizens residing in the EU, or EU citizens generally?
If it's the latter, then someone with both US and German citizenship could be covered even if they've never been to the EU.
Re: GDPR for lazy people: Block all European users with Cloudflare Workers
#19How does CloudFlare know if someone is a citizen of the EU and traveling abroad? In haproxy, I redirect a few accept-language headers, but even this has its faults.
You aren't a data subject if you're outside the EU. If you're in the US, data will be happily collected on you irrespective of GDPR.
Re: GDPR for lazy people: Block all European users with Cloudflare Workers
#20Considered this before, but it doesnt work. IIRC, the law applies to euro citizens both living in country and abroad. As such, geoip blocking is not a working strategy. (a french citizen who lives in japan still had GDPR rights) A better one would likely be a clickwrap agreement for all users stating "European citizens are not allowed on this service" which they have to click a "I am not european" tickbox to.
I'm the author of the post, and yes: blocking 500 million geolocated people is crazy. That's not the spirit of the law. I just wrote the post because if you want to overkill and you are lazy, you can follow our recipe to 'implement' GDPR. I just wanted to be sarcastic and also show how easy to implement Cloudworkers + Apility.io.
Blocking 500 million geolocated people is crazy. That's not the spirit of the law.
No crazier than thinking you have to comply if you have no connection to the EU.