2., The EU is a very rich, large market - considered the single largest economy in the world (GDP per capita). Good luck not targeting it with your products.

3., The pendulum around data protection is swinging back, this is normal. Apple saw it and adjusted already. Google is cooperating and staying quiet. Only FB is stupid enough to fight in courts.

Anyone can claim jurisdiction. Enforcement is another matter entirely. If there is no presence in Europe, I can't imagine how the they would collect.

I've worked with companies as small as 200 people who have a presence in the EU.

Facebook have no business in the EU unless they are selling advertising to EU companies

I would not rule it out on principle but it is highly unlikely.

If FB were to be shut down tomorrow I would probably not even notice.

Based just on the fact that you are on HN, this is, uhm... highly unlikely.

By the way, I wonder how it would actually look like. I mean, if FB was actually blocked in Germany or something like that, I imagine people (the victims of FB crimes) would very much vocally defend FB, claiming they don't give a fuck about their privacy. Which I cannot decide if it's funny or not.

GDP per cápita in the EU is around $37k. The US is $57k per cápita.

That puts it at 46th in the rankings.

https://en.m.wikipedia.org/wiki/Economy_of_the_European_Unio...

So if a social media platform strictly based outside of the EU "exports PII" from an EU resident there isn't anything the EU can do about it, other than asking google or apple to take their app off the app store or somehow blocking the domain across the EU.

> You do realize the EU can stop or confiscate the money that is transferred to you from European customers?

I don't have any money being transferred to me from European customers.

Unless the EU has a treaty with the non-EU country me and my site are in that provides for the enforcement of EU fines in this area in me or my buyer's country, how are they going to actually enforce a fine against me?

• I run website W. W does not obey EU privacy and data rules, but I, my company, my server, etc., are all outside the EU in places without treaties that would allow enforcement of EU rules against me.

• I sell data from EU citizens who visit W. I sell this data to ad network N that is also outside the EU. (I'm selling N all my visitor data, not just data from EU visitors).

• Company C that is in the EU or sells products in the EU or has a presence in the EU buys ads through N. N uses the data they bought from me to show C's ads to visitors from the EU who visit websites using N's ad network.

Questions:

1. Which of the various entities in this (me, N, C) are violating EU data and privacy laws, according to the EU?

2. Which of those entities could the EU actually enforce a fine against?

3. For those entities that are violating EU laws (according to the EU) but are out of the reach of EU fines, can the EU take alternate action such as ordering EU ISPs to block access to their websites?

I think that's the gist of the GDPR. Make personal data toxic.

2. I remember people saying that about China. The market was too big to ignore. Somehow Facebook got banned in China completely and did fine. Same for YouTube, Twitter, etc. They're companies any founder could be proud of. You could serve the US market and make money advertising to EU member state citizens without having a corporate presence in the EU, it'd still be a nice business.

3. Hardly, Apple / Ireland are appealing the EU tax ruling, Google has been getting fined repeatedly for things like Google Shopping and maybe Android, FB getting fined is nothing new. And what's "stupid" about fighting in courts ... unless you believe the EU's courts are kangaroo courts that are guaranteed to always take the EU's side? Why shouldn't they appeal? It's hardly like these cases are bulletproof. Most of them can't even explain what precisely was wrong.

http://europa.eu/rapid/press-release_IP-17-1784_en.htm

Seems very clear what is wrong.

I'm thinking that perhaps it's a good thing that future companies like FB can't take off in Europe. The need for a product like FB is clear, and if the rules prohibit FB like companies from taking root, then it gives grassroots or open source a chance. We'll see.

Nor are any of the other cases clear cut. Apple's case isn't even about Apple, it's more like a power struggle between the Commission and the Irish government.

We saw how Germans reacted to the rise of Facebook years ago. It wasn't through some 'grassroots' social network or open source. It was simply a local clone of Facebook, China style, right down to cloning the UI:

https://techcrunch.com/2008/07/18/facebook-sues-german-socia...

If the EU succeeds in convincing the rest of the world that it sees their firms as cash cows, all that'll happen is that people who live in member states will have to live with crappy local ripoffs - no different to China.

> "Evidence shows that even the most highly ranked rival service appears on average only on page four of Google's search results, and others appear even further down"

I think this is a death sentence for any website whose that previously depended on unbiased search results. I remember reading sometime in the past that virtually all clicks go to the first two results, third and fourth barely receiving any, and other pages not even visited.

Combined with the fact that google supplied 90% of all search traffic it looks clear that they were starving their competitors.

To be honest I'm also skeptical of any open source, (hopefully distributed) social network from ever coming into existence. But I'm equally sure that what FB, and google, are doing with information about me is not the way to go. They are earning money with the information they are endlessly slurping up about me in any way they can. Rarely with my _informed_ consent. And if this is how the EU fights back, I'm all for it.

Off topic/related:

Like the bait and switch they do with youtube. I've had an account there for ages, long before social networks were a thing. I've got content up there, 2k video's that I've liked and would like to be able to keep visiting. But it has happened a number of times where I was forced to 'accept' the changes to the TOS. Youtube does not allow me to download my liked video's easily. Apparently what they are doing is not illegal, or maybe the courts have not caught up to the things like this yet. But it does create an adversarial relationship, therefore I dislike youtube, and loathe facebook and google these days. They are constantly taking steps to my disadvantage.

Don't get me started about the maps thing. They're very keen on defining Google search as Web search, and neatly divided search engines. Don't know about you, but if I put an address into Google search I expect a map back, and it's daft to expect Google to guess how to find it on a competitors sites when they have (likely better) data at their disposal. And yes, they got ruled against for this.(giving a helpful Google map result if I input an address)

Good.

Further, I fail to see why "voluntering" it is relevant at all.

I've got no recourse against this - or maybe I have because Facebook is big enough that it's worth it to create targeted block lists. But against the next 20 smaller companies who do the same?

This is why there needs to be something else than just blindly trusting everyone out there. Because someone will not play fair if theres a competitive edge to gain.

Citation needed? Facebook gets revenue from their ad network, which is used by European business customers and targets European users. Therefore they need to comply with European law.

I've never heard of this before, is it a part of GDPR?

The Facebook Europeans use is very much an EU company.

https://boingboing.net/2017/11/08/involuntary-profiling.html

"Facebook is well understood as being a major customer of third-party data-brokers, who compile huge dossiers on people based on their spending, internet and phone usage, employment history and so on. In addition, Facebook encourages users to upload their entire address books to the system to "find your friends," and users generally don't appreciate that they may be leaking sensitive information, including nicknames, private numbers, and connections to the system.

Facebook mines this data to create "shadow profiles" of its billions of users. These are profiles that are filled with data about you that you have never consciously provided to the system -- data mined from third parties, including your friends, but also those spooky data-brokers. Facebook's shadow profile system was first confirmed in 2013 when it accidentally leaked users' shadow profiles to them along with their own data, something the company says it will never do again out of (ironic) respect for the privacy of the people who provided the data that goes into your shadow profile.

Facebook's shadow profiles are involuntary and there's no opt-out. Facebook has shadow profiles on people who don't use the service. For example, even though I'm not a Facebook user, multiple people have uploaded their address books containing my email and phone number to the system, allowing Facebook to create a profile of my contacts by looking at who lists me as a contact."

Facebook’s reckless use of private data is a public hazard not unlike passive smoking. It’s not going to be solved by an asymmetric fake free market where customers are free to choose an option that doesn’t exist.

In my recollection, in the US, 30 years ago restaurants had "smoking" and "non-smoking" sections. And non-smokers sometimes complained bitterly about smoke wafting into the "non-smoking" section. Which in fact led to some restaurants being all non-smoking before government intervention. The NY statewide ban on smoking in workplaces was only passed 15 years ago.

I don't know about bars 30 years ago, though. Because drinking has always been considered a "vice", I think people tended to group it with smoking and think if you're going to tolerate one, why not the other.

Smoking bans in restaurants and bars have made a significant difference in most states.

If I remember correctly, we had a non-binding agreement between the health ministry and our national restaurant and hotel organisation at first, but this did not change much.

Even most smokers I know agree that the laws were necessary, and that they are thankful for them because otherwise they would not go outside to smoke.

It also makes them more likely to buy them illegally.

That is an inappropriate accusation. In Germany, large data collections have been seen as very problematic since before social networks were a thing. Authoritive action and laws take time to adapt to new problems. Given the prevalance of social networks like Facebook nowadays sped up the process, but I'm confident it would have come sooner or later anyways.

Also, Europe is certainly a place where one can do business very fine. Handling data about other people they are not aware of or don't consent to is a very specific aspect. Just don't record data about other people and you are fine in this aspect.

"Facebook hides default settings that are not privacy-friendly in its privacy center and does not provide sufficient information about it when users register"

How is putting privacy settings in the privacy center hiding them? What is "sufficient" information when users register? Where in law are these things spelled out?

Germany isn't punishing Facebook for anything actually concrete or real. Rather the German courts and regulators seem to think they should design Facebook's UI instead of Facebook. This is not how free markets work and if you were creating a new company, why let some random German regional court waste your time on disputes over the position of widgets in your user interface?

There is no such thing as a fully free market, and that is a good thing.

The complaint is not that they want to control every detail. Certain parts of the agreements might simply not be valid just by clicking a check box, or the parts are not displayed in a form that is considered appropiate. Imagine a document with 15000 words that is unnegotiable by you. Will your mother read that so she can give meaningful consent? I don't think so, so the consent isn't valid. This line of reasoning is about common sense, and not about formalities, and I'm glad it is relevant in law.

Facebook is a national security risk and should not be let to reign free as it likes. I see no problem if we tame a vulnerability - the way it handles our personal data, how it uses it to push ads and politics, how it influences elections by tweaking the feeds. Not to mention that it doesn't like to pay taxes in EU.

Your brain has been broken by money.

2) It is a very politically stable block, with low crime and corruption, war etc.

3) 51% of the population speak English as a first or second language[1]

4) High levels of literacy

5) Free market

Sounds like a really excellent place to sell advertising, as long as you don't mind not exploiting consumers. Why would you avoid it? In favour of where?

[0]https://en.wikipedia.org/wiki/List_of_countries_by_GDP_(nomi... [1]https://en.wikipedia.org/wiki/Languages_of_the_European_Unio...

Social media is a psychological weapon that can disrupt a society to the point at which it can no longer function. Look at Libya or Syria. Look at how fractured the US is. If you want to point it at someone else, that would be nice.

From https://www.wired.com/story/inside-facebook-mark-zuckerberg-... it would appear that these lessons are being learned, somewhat slowly.

    Zuckerberg had reason to take the meeting (with 
    Rupert Murdoch) especially seriously, according 
    to a former Facebook executive, because he had 
    firsthand knowledge of Murdoch’s skill in the 
    dark arts. Back in 2007, Facebook had come under 
    criticism from 49 state attorneys general for 
    failing to protect young Facebook users from 
    sexual predators and inappropriate content. 
    Concerned parents had written to Connecticut 
    attorney general Richard Blumenthal, who opened 
    an investigation, and to The New York Times, 
    which published a story. But according to a 
    former Facebook executive in a position to 
    know, the company believed that many of the 
    Facebook accounts and the predatory behavior 
    the letters referenced were fakes, traceable 
    to News Corp lawyers or others working for  
    Murdoch, who owned Facebook’s biggest competitor,
    MySpace. “We traced the creation of the Facebook 
    accounts to IP addresses at the Apple store a 
    block away from the MySpace offices in Santa 
    Monica,” the executive says. “Facebook then traced 
    interactions with those accounts to News Corp lawyers. 
    When it comes to Facebook, Murdoch has been playing 
    every angle he can for a long time.” (Both News Corp and 
    its spinoff 21st Century Fox declined to comment.)

If I upload data to Dropbox, my bank, or my health insurance, I don't expect them to be sold to advertisers either. So what if there was a social network that actually respected its users and didn't exploit their data for its own ulterior motives? Seems to be an inconceivable notion to some.

So does the EU [1].

"The European Patent Convention states that software is not patentable. But laws are always interpreted by courts, and in this case interpretations of the law differ. So the European Patents Office (EPO) grants software patents by declaring them as 'computer implemented inventions'".

[1] https://fsfe.org/campaigns/swpat/swpat.en.html

And nothing of value was lost.

https://news.ycombinator.com/newsguidelines.html

The EU isn't fining its firms. It is fining US firms. Big difference.