> 1., If you store data of EU residents, you are under EU jurisdiction (GDPR) and can be targeted by fines.

Anyone can claim jurisdiction. Enforcement is another matter entirely. If there is no presence in Europe, I can't imagine how the they would collect.

If you're large enough to be noticed and fined, you've probably got a corporate presence in EU; if only for the tax benefits.

I've worked with companies as small as 200 people who have a presence in the EU.

Perhaps not so surprisingly, most people that would want to pay money for data on European data, resides in Europe. And if you receive payments from Europe, you are definitely in the jurisdiction.

Depends on the treaties setup with the US, assuming that is where the company is based. It may be possible to take some EU judgements to a US court and have them enforce it.

I would target the channels whereby the funds from their massive advertising sales are being routed, probably

Facebook have no business in the EU unless they are selling advertising to EU companies

Yes, unfortunately, in the case of FB there is.

Unfortunately?

For them. Fortunately for the rest of us, they have a solid foot on the ground both in NL and Ireland.

I see. For a second it seemed you were defending Facebook!

> For a second it seemed you were defending Facebook!

I would not rule it out on principle but it is highly unlikely.

If FB were to be shut down tomorrow I would probably not even notice.

> If FB were to be shut down tomorrow I would probably not even notice.

Based just on the fact that you are on HN, this is, uhm... highly unlikely.

By the way, I wonder how it would actually look like. I mean, if FB was actually blocked in Germany or something like that, I imagine people (the victims of FB crimes) would very much vocally defend FB, claiming they don't give a fuck about their privacy. Which I cannot decide if it's funny or not.

Largest economy in the world per capita? Where did you get your numbers?

GDP per cápita in the EU is around $37k. The US is $57k per cápita.

That puts it at 46th in the rankings.

https://en.m.wikipedia.org/wiki/Economy_of_the_European_Unio...

Addressing your point #1, the EU has no enforcement mechanism for fines or otherwise unless you have physical presence (servers, offices etc...) in an EU member nation or are processing money on EU run systems.

So if a social media platform strictly based outside of the EU "exports PII" from an EU resident there isn't anything the EU can do about it, other than asking google or apple to take their app off the app store or somehow blocking the domain across the EU.

You do realize the EU can stop or confiscate the money that is transferred to you from European customers? Noneuropean companies already have to pay VAT on stuff they export to EU, so it is not as if there is no big collection already going on.

Suppose I put up a website hosted on a server I own in a non-EU country. A person from the EU visits the site, I gather their personal information, and I sell that information to a non-EU buyer blatantly in violation of EU privacy law. I have no offices, bank accounts, property, service providers, subsidiaries, suppliers, customers, etc., in the EU.

> You do realize the EU can stop or confiscate the money that is transferred to you from European customers?

I don't have any money being transferred to me from European customers.

Unless the EU has a treaty with the non-EU country me and my site are in that provides for the enforcement of EU fines in this area in me or my buyer's country, how are they going to actually enforce a fine against me?

You can probably get a lot less if you try to sell the data to non-EU entities compared to local ones though. Same for advertisement prices.

That raises some interesting questions. Let's say:

• I run website W. W does not obey EU privacy and data rules, but I, my company, my server, etc., are all outside the EU in places without treaties that would allow enforcement of EU rules against me.

• I sell data from EU citizens who visit W. I sell this data to ad network N that is also outside the EU. (I'm selling N all my visitor data, not just data from EU visitors).

• Company C that is in the EU or sells products in the EU or has a presence in the EU buys ads through N. N uses the data they bought from me to show C's ads to visitors from the EU who visit websites using N's ad network.

Questions:

1. Which of the various entities in this (me, N, C) are violating EU data and privacy laws, according to the EU?

2. Which of those entities could the EU actually enforce a fine against?

3. For those entities that are violating EU laws (according to the EU) but are out of the reach of EU fines, can the EU take alternate action such as ordering EU ISPs to block access to their websites?

N is definitely violating EU laws. It handles data of EU citizens without their consent. The EU could stop the cash flow from C to N. It's rather simple: You can't purchase products which are made illegally. As much as I can't legally buy DDOS services, even if the provider is outside my jurisdiction.

I think that's the gist of the GDPR. Make personal data toxic.

Yes exactly, if you don't have EU customers then again there is no risk.

1. GDPR is a good example of why to abandon the market imo. It's not even clear how it affects backup strategies, let alone more complicated questions. Most vaguely written law I've seen in a long time. I can't help but suspect it's designed to be violated, as a revenue source. But just don't set up a corporate presence in the EU and they can't do much.

2. I remember people saying that about China. The market was too big to ignore. Somehow Facebook got banned in China completely and did fine. Same for YouTube, Twitter, etc. They're companies any founder could be proud of. You could serve the US market and make money advertising to EU member state citizens without having a corporate presence in the EU, it'd still be a nice business.

3. Hardly, Apple / Ireland are appealing the EU tax ruling, Google has been getting fined repeatedly for things like Google Shopping and maybe Android, FB getting fined is nothing new. And what's "stupid" about fighting in courts ... unless you believe the EU's courts are kangaroo courts that are guaranteed to always take the EU's side? Why shouldn't they appeal? It's hardly like these cases are bulletproof. Most of them can't even explain what precisely was wrong.

I have a hard time seeing how you came to your conclusions about point 3. The rulings seem crystal clear and are explained in normal language. Take the google shopping case:

http://europa.eu/rapid/press-release_IP-17-1784_en.htm

Seems very clear what is wrong.

I'm thinking that perhaps it's a good thing that future companies like FB can't take off in Europe. The need for a product like FB is clear, and if the rules prohibit FB like companies from taking root, then it gives grassroots or open source a chance. We'll see.

I disagree. I followed the shopping case closely. At no point was it obvious what Google did wrong, or why providing shopping results is a problem but not maps or videos, or how you would predict and avoid such problems in a new company and product line.

Nor are any of the other cases clear cut. Apple's case isn't even about Apple, it's more like a power struggle between the Commission and the Irish government.

We saw how Germans reacted to the rise of Facebook years ago. It wasn't through some 'grassroots' social network or open source. It was simply a local clone of Facebook, China style, right down to cloning the UI:

https://techcrunch.com/2008/07/18/facebook-sues-german-socia...

If the EU succeeds in convincing the rest of the world that it sees their firms as cash cows, all that'll happen is that people who live in member states will have to live with crappy local ripoffs - no different to China.

I must admit that I've not followed the case all that closely. But, assuming that the document does not lie, this part looks like a huge problem:

> "Evidence shows that even the most highly ranked rival service appears on average only on page four of Google's search results, and others appear even further down"

I think this is a death sentence for any website whose that previously depended on unbiased search results. I remember reading sometime in the past that virtually all clicks go to the first two results, third and fourth barely receiving any, and other pages not even visited.

Combined with the fact that google supplied 90% of all search traffic it looks clear that they were starving their competitors.

To be honest I'm also skeptical of any open source, (hopefully distributed) social network from ever coming into existence. But I'm equally sure that what FB, and google, are doing with information about me is not the way to go. They are earning money with the information they are endlessly slurping up about me in any way they can. Rarely with my _informed_ consent. And if this is how the EU fights back, I'm all for it.

Off topic/related:

Like the bait and switch they do with youtube. I've had an account there for ages, long before social networks were a thing. I've got content up there, 2k video's that I've liked and would like to be able to keep visiting. But it has happened a number of times where I was forced to 'accept' the changes to the TOS. Youtube does not allow me to download my liked video's easily. Apparently what they are doing is not illegal, or maybe the courts have not caught up to the things like this yet. But it does create an adversarial relationship, therefore I dislike youtube, and loathe facebook and google these days. They are constantly taking steps to my disadvantage.

You're missing the bit where the sites in question are basically zero value link farms, who got downranked for low quality content.

Don't get me started about the maps thing. They're very keen on defining Google search as Web search, and neatly divided search engines. Don't know about you, but if I put an address into Google search I expect a map back, and it's daft to expect Google to guess how to find it on a competitors sites when they have (likely better) data at their disposal. And yes, they got ruled against for this.(giving a helpful Google map result if I input an address)