GDPR compliance as a service

Good question. An American court won’t enforce it, but any decent-sized entity is, for all practical purposes, subject to decisions by ECJ (and potentially by individual EU countries).

If an EU resident case is brought to ECJ, they’ll almost certainly have jurisdiction, so the question is what ECJ would rule. I wouldn’t bet my compliance strategy on the ECJ deciding that an EU resident opted out of GDPR by misstating their residency (intentionally or not). One can reasonably assume that ECJ would see requiring users to explicitly state their location as a mitigating factor, but not that it would eliminate the need to comply, nor the opportunity for EU litigation claiming the same.

Again, this is not legal advice, but I’ve actually read the GDPR and and been part of a large company working through how to comply with it.

Yes, the lack of assets and revenue would make it difficult to collect. Exposure could include a staff member wanting to visit an EU country, the company trying to hire an EU-based remote contractor, or trying to get credit in the US.

That said, the reasoning is simpler: even if there's literally zero interaction with or exposure to the EU, by the time a complaint gets to litigation, the company's approach to GDPR has already failed. erely being party to a case in any court (let alone losing one) isn't a trivial matter -- it means at least consulting an attorney and thinking through the implications (like perhaps not being able to obtain an EU visa). A GDPR strategy which gets to that point, and relies on the inability to collect a judgment, has failed.

Facebook - really, FANG and a handful of other name-brand, global, consumer-facing companies - differ from most businesses in 2 ways:

1. They expect litigation, complaints, and article 17 erasure requests. There's no way to avoid it, just plan around it and minimize the impact. Their goal isn't no impact, it's no catastrophic impact.

2. They have teams of attorneys analyzing the risk and benefit of every decision. If they've decided (not) to do something, it's because they've accepted that the risks are worth the benefits, not necessarily because they think it's risk-free. Even most mid-market businesses don't have that luxury.

Note also that my original comment said that experts debate whether user-submitted location is sufficient. I explicitly didn't and don't claim that there's any certainty. There's no case law at all right now, so anyone who claims certainty about edge cases is making stuff up.

What is close to certain is that IP-based geocoding (ie, what this vendor provides) doesn't eliminate anywhere near all visitors from the EU, and thus doesn't eliminate the need to consider GDPR. Perhaps they decide to also add a user-submitted location dropdown to their signup form and accept the risks I just described, or decide to do nothing else and accept the risk of litigation from EU visitors who the geocoding doesn't identify. My core point is that the geocoding service pitches "Just block EU IPs and you're done," and that's not the case at all.

I think we're past the point where HN comments are adding value, so this will be my last comment in this thread.

Lying does not necessarily waive rights. E.g. purgery does not waive 5th amendment rights. Hence "may well still". If you know this _not_ to be case here, do share.

> If it's true, then literally everyone in the world is covered by the GDPR

You mean GDPR is a massive overreach where one organization is trying to regulate effectively the entire internet? Yeah, that about sums it up.

1. To within some threshold of certainty, it is not yet possible to determine whether blocking EU visitors by IP, asking the remainder if they are subject to the GDPR, and blocking them if they say yes complies.

2. To within that same threshold, I can determine that some other plan (e.g., whatever troydavis is implementing) complies.

For anyone who thinks both of these can be true: Are you sure that you're basing those statements on the law? Or do you mean that the regulators will view (1) unfavorably and go after you, but they'll treat (2) as a good-faith effort and be nice?

The latter is probably true, but it's not the rule of law. Are you okay with that? How sure are you that all those regulators (and courts) will always behave in the way that you predict, or a way that you personally consider right?

I am disturbed by how willing most commenters are here to abandon the rule of law when it gets them something they want. Selective enforcement of regulations on business is a routine tactic of unfree states--remember the guy with the leopard-print fabric in Russia? I don't think it's a good idea to create powerful new tools for that, just because Europe--a continent that within living memory harbored some of the worst dictators of modern history--is well-governed right now.