I keep seeing these posts on how to block European users to avoid the GDPR. As a citizen of Europe, seeing these posts consistently making it to the front page is disappointing. It would seem that Silicon Valley perceives the GDPR as more of a hindrance than an opportunity to offer users better privacy. Nothing has been learned.
If there's a successful business that blocks EU access due to GDPR, that's a huge immediate opportunity to enter that market in the EU (unless, of course, the business model is based on resale of personal information).
Which is exactly the point of the law — it’s a trade barrier.
As a developer I can understand this point of view, but as a consumer I say it's time to grow up. Internet startups have taken a "move fast and break things" approach that is analogous to early industrial revolution approaches to worker safety, product efficacy and safety, and environmental protection. You're working in the real world, with real consequences if you end up exposing people's personal data. The party is…
> You're working in the real world, with real consequences if you end up exposing people's personal data. The party is ending. Either deal with it, or find something else to do. They are dealing with it... by limiting their liability.
Yeah but what they actually do is removing themself from market place. If I were looking for a startup, I would check for someone banning EU users, with prospective idea and copy what they have done, but GDPR oriented and voila, I am first on the market, slowly taking over the original site bussiness in EU and later the world. EU is a huge marketplace and you really need to be extremly short minded to avoid it due to some stupi legislation, not to mention that as a US cityzen I would abandon any site not going for GDPR compliancy as they are saying to me, between the lines, "we are bastardising my data". Like seeing a laser pointer on your forehead.
GDPR has effects way beyond better user privacy. Sorry I've been pasting this in multiple GDPR related threads, but here it goes: I have a profitable, bootstrapped SaaS business based in US. It's not based on ads or selling data. I don't even have a freemium plan. Only a limited free trial after which you have to start paying. It's a trivial application that stores mostly already public data. Only email is required t…
Wait a minute… You provide a service, and your users are afraid the GDPR could come to them ?!? Please tell me I've read something wrong. Otherwise, this is just panic induced stupidity. I expect they will grow out of it (though maybe not before you go bankrupt, which obviously sucks big time).
It's pure FUD and panic. I think the only item most people have actually read is 4% revenue or 20M fine which ever is greater. It's unfortunate, but was the only way to get the Googles and FBs of the world to pay attention.
I can see why you'd be disappointed - if popular websites started blocking US customers I'd be pretty bummed out as well (even if it was easy to circumvent). As a dev though, I also understand the frustration. Creating startups is already time-intensive and stressful. A lot of us are on shoestring budgets. Most startups will fail. To a solo developer in the US, the idea of spending time understanding and complying wi…
As a developer I can understand this point of view, but as a consumer I say it's time to grow up. Internet startups have taken a "move fast and break things" approach that is analogous to early industrial revolution approaches to worker safety, product efficacy and safety, and environmental protection. You're working in the real world, with real consequences if you end up exposing people's personal data. The party is…
I agree that exposing personal data is serious, and companies should be held responsible if they violate the terms of their privacy policy. I think companies should follow the law of the land.
The thing about GDPR that I disagree with is how it aims to have global jurisdiction. If it was a US law (as a US-based developer), perhaps I'd protest it, but I'd still follow it if I wanted to work in software.
I simply don't understand how or why a law that has scope in the EU is causing trouble for companies which conduct no business in the EU beyond responding to HTTP requests on a global decentralized telecommunications network. Why would an American internet business which conducts no operations in Europe and has no servers in Europe be subject to regulation that affects the EU? What is going to happen? Is the EU going…
> Is the EU going to target American banks of American businesses and try to extract fines? You mean like America? That time when the USA decided to enforce their embargo against Cuba by intercepting a payment from one of the Nordics for a bunch of Cuban cigars? No, that's unlikely. > Is the EU going to extradite owners of these businesses? Extremely unlikely, besides that would require the cooperation of the other c…
> You mean like America?
Yes, like America. This may shock you, but America isn't always right.
Just curious, but what does the investors think when a company volentarly leaves the EU market because it is easier to simply ignore eu as a market then to comply to GDPR?
It all depends on your investors and who your company's target audience is. If I run a business putting up American flags on people's houses on patriotic holidays (an actual business in my neighborhood), then ignoring the EU market is an easy decision because I already was.
And if you presented a nice growth graph over American customers with the implication for expansion over other regions such as EU, whats the possibility that some investors considered that potential when they invested?
Like say a software service which I would assume is more common investment target here rather than flags.
While I know they are not recommending, recommending this, for everyone who does, this doesn’t get you off the hook at all unless you are a new site who has never had EU visitors. Also of course all the EU citizens in the US, GDPR would presumably still apply.
Regarding the last point, I'm not sure why this point is still being parroted, despite so frequently being corrected:
The GDPR applies to any residents of the EU, not EU citizens regardless of location.
I keep seeing these posts on how to block European users to avoid the GDPR. As a citizen of Europe, seeing these posts consistently making it to the front page is disappointing. It would seem that Silicon Valley perceives the GDPR as more of a hindrance than an opportunity to offer users better privacy. Nothing has been learned.
HN is full of morally totaly unscrupulous people. The typical Silicon Valley crowd actually celebrates the kind of privacy invasion that the GDPR is design to counteract. So, obviously it's no big surprise that these Silicon Valley bros post silly tips on how to avoid the GDPR by just blocking the pesky Europeans.
They will learn. It's a financial certainty.
On a separate note: I feel totally disgusted with the kind of people who are totally uninterested with the the fate of their users. It's not exactly uncommon in Silicon Valley. Fuck these guys.
Considered this before, but it doesnt work. IIRC, the law applies to euro citizens both living in country and abroad. As such, geoip blocking is not a working strategy. (a french citizen who lives in japan still had GDPR rights) A better one would likely be a clickwrap agreement for all users stating "European citizens are not allowed on this service" which they have to click a "I am not european" tickbox to.
I'm the author of the post, and yes: blocking 500 million geolocated people is crazy. That's not the spirit of the law. I just wrote the post because if you want to overkill and you are lazy, you can follow our recipe to 'implement' GDPR. I just wanted to be sarcastic and also show how easy to implement Cloudworkers + Apility.io.
Your post was really hilarious. It's the first funny thing I've seen about GDPR, which among other things has unexploited potential for humor.