I admit that I'd do that. Lowest friction solution. I don't want law enforcement agencies knocking on my door because I host a hobby project on a free / $5 tier VPS for years.

My intent isn't malicious. I simply don't want to invest in more maintenance. Hence I'd block EU, yes.

Do you also block all US IPs to avoid patent infringement claims? What makes you think the GDPR is broader in scope than the patents the USPTO hands out? In the patents' case, there is even a direct financial incentive for companies to sue you, whereas in the GPDR the interest of the regulatory body is primarily compliance.

That won't completely protect you, it would only greatly reduce your surface of exposure; the eu user could still reach you via a vpn or simply sign up while vising the US.

Ask if user is European, and if they answered yes, deny them service. If they lie, then you have plausible deniability to mistreat their data.

Users of free services will just set their country to non-EU, and continue to consume the services. GDPR will gave achieved nothing in that case.

If you have no presence in the EU, to what sort of "risk" do you refer?

I havent read the papers but only few online summaries, but each mentions very strongly that GDPR directive are not limited to you running business or webste in EU zine. You need to implement GDPR if someone in Australia is using European IP. You also should assume that signup IS EUROPEAN if you havent given them the chance to say otherwise on your registration form. For example European citizen can visit your US based website when he/she visits USA, sign up then go home. Since she/he is EU citizen, you need full complience on your end. Or face €20 mil fine (I assume your startup is not making more than that off of 4% revenue)

How is the EU court going to fine your American corporation?

They can arrest the CEO if they step foot on EU soil.

I don't imagine a European country arresting an American for something that was done in America that is legal to do in America would go over real well with the US government.

https://en.m.wikipedia.org/wiki/United_States_v._Elcom_Ltd.?

This stems from the United States making their laws apply globally.

Your link does not work, because it ends in a period. HN takes the period as being the end of the sentence rather than as being part of the link. Here are working links (mobile, non-mobile):

https://en.m.wikipedia.org/wiki/United_States_v._Elcom_Ltd.?

https://en.wikipedia.org/wiki/United_States_v._Elcom_Ltd.?

Also question how would they know who owns the company? I don't think US Gov would easily give out info on US company to foreign country or Union for such no-crime related abuse.

Yes, I understand all of that. But you didn't answer my question.

My company has no presence in EU, and neither myself, nor any one of my employees are going there.

What's the risk?

The risk is an EU court telling google to stop dealing with you because you're in violation, or even worse: a payment processor like Visa. No to mention that you and your employees are now unable to safely fly anywhere within the EU or anywhere with an extradition treaty with them.

so would it be sufficient to add a line to the TOS checkbox label: "I affirm that I am not a citizen of a EU-affiliated country"

that seems simple enough - I think I'll add that to the projects I'm working on.

Not enough. You also need a screenshoot of the form they completed and you need to keep it on file.

There is so much info I read on this today I closed the article but it said that their ticked-box consent and IP is not sufficient.

You don't necessarily need a screenshot, a copy of the webpage the user saw would IMO be sufficient.

You need to be able to show the user agreed and what they agreed to exactly. A screenshot might do that but might also not be sufficient (if there is more text elsewhere on the signup process related to privacy)

For all downvoters:

https://www.mailjet.com/gdpr/consent/

Scroll to: How do I store consent under GDPR?

The record of the IP address, location and time at which someone submitted a consent form is insufficient without a screen capture of the form itself.

You welcome!

The specific recital is here: https://gdpr-info.eu/recitals/no-42/

A screen capture is the easiest way to achieve compliance but the regulation leaves open other methods as long as you can show that someone gave consent and to what exactly. (IMO you could also store the HTML of the webpage they viewed at the time)

That’s the weirdest thing. What do the law mean with a “screenshot of the form”

There is nothing about a screenshot in the law.

The law says you have to be able to prove the user ticked the box and provide an audit trail for it, IIRC some recitals mentioning that you should be able to reproduce the exact agreements the user made (ie, either in text or as a screenshot) so that you can later show the user and any regulatory body that asks what they agreed on.

The regulation is about capturing data of EU citizens, regardless of what IP they reach you from -- so this won't keep you safe.

That's not what it says. See Article 3 [1], and the accompanying recitals.

[1] https://gdpr-info.eu/art-3-gdpr/

No, those recitals are exactly what make my point. Numbers 23 and 24 of the accompanying recitals on that page state that, even if you are not established in the EU, if you profile people "within the EU", the regulation claims to apply.

"Within" is a physical location, so arguing that IP block associated with request is a perfect proxy is at best a legal grey area. For example, an EU citizen could use a VPN to access your services and then send you a data request. See here for discussion: https://www.gdpr360.com/gdpr-ip-addresses-and-classification...

If this seems like a low risk incident, consider that there are litigious people inside the EU (as everywhere) that may actively explore the boundaries of the law.

Careful. You were talking about capturing data in the comment I responded to. Now you are talking about profiling. These are distinct things under GDPR, with different rules.

Profiling data subjects in the EU is covered, regardless of where the processor/controller is located.

If you are processing personal data but not profiling and you are not established in the union it only applies if the processing is related to the offering of goods and services to data subjects in the Union.

For those who are not profiling, blocking EU IP addresses should help establish that they were not envisaging offering goods and services in the Union.

I was loose in introducing the word "capture", which blurred the distinction you're making. But the OC seems to be suggesting that IP blocking is likely to be a one stop solution for someone trying to avoid GDPR details, and your replies leave open that impression.

In fact, there are many ways someone might be profiling without knowing it. For example, precedent about when logging IP addresses constitutes PII is still evolving and seems to apply in cases that would be unintuitive to many US businesses: https://www.whitecase.com/people/tim-hickman. And there have been arguments that geolocating based on IP might itself be data enrichment that contributes to an argument that you are profiling!

Similarly, I haven't seen a clean interpretation of what constitutes offering (or clearly not offering) services to EU users, which determines application to a data processor. For example, if I offer a Portuguese translation of my site for Brazilian users, have I offered service to continental Portuguese?

IANAL but nobody knows exactly where GDPR will apply yet. I think the better takeaway for someone who is trying to respond with minimum effort is: IP blocking might help you build a defense, but it might matter how you implement it and it might not be sufficient.

Note that the regulation talks about where the requester is, not where they report to be.

Some legitimate experts have concluded that this wording allows someone in the EU using a vpn they reports them as coming from outside the EU to be covered.

That seems like a low risk incident to me, but I’m not a lawyer & I can see where that interpretation comes from.