International enforcement is a can of worms.

However, a lot of it is covered by:

1- US companies with a physical presence in the EU. They can fine that entity directly.

2- US companies will find they can't sell to EU businesses (B2B), as that means the EU company is carrying the can in terms of non-compliance.

3- The EU Member State could go via the International Courts. Or via some kind of bilateral agreement (e.g. Privacy Shield).

I expect #3 will need to egregious to really make sense.

However, I also expect a significant amount is already hovered up by #1 or #2. Certainly many of the cases that GDPR wants to target.

Additionally, the EU may cut deals with other states to bring in enforcement powers (fines).

Seems this is targeted mainly to the likes of uber, google.. small time websites who do not have much volume aren’t the target audience.

At the moment there is no way the EU can enforce you to comply with that law, unless you have a subsidiary in the EU. Only if USA sign a special agreement with the EU this may change, but I don't think this will ever happen (very unlikely). Otherwise every country on planet can create their own draconian laws and expect that every single company in the world comply with it...

this is true, but kinda pointless, you are not gonna fight the EU over this... Several countries in the EU (UK, Ireland, ...) can assign personal liability for intentionally ignoring privacy law, in which case someone in your company is basically going to end up a wanted man in Europe

> Several countries in the EU (UK, Ireland, ...)

UK is not part of the EU.

> assign personal liability

Citation needed? If CEO decides to ignore privacy law, everyone else is accountable?

The most likely solution is the same way the US enforces US laws (e.g. Megaupload case) in other countries: Seizing their assets (through cooperation with banks) and then asking for extradition.

Frightening to think something as innoculus as making a website of chocolate chip recipes and logging visitor IPs could provoke that.

Your chocolate chip recipe website will have to be compliant to a number of laws, GDPR isn't the only law in the internet.

It wouldn't, that's just pure FUD.

Tip: don’t log the IPs then.

I spin up a Wordpress site with default options to host my chocolate chip recipes. Is it GDPR compliant?

I go through and toggle all the settings the internet tells me to, even though I don't know their meaning or effect. Am I GDPR compliant?

I install a Wordpress plugin that sets up a Really Simple Chocolate Chip Syndication server, or RSCCS. That plugin logs IPs. If I was GDPR compliant previously, now I'm not, and how would I ever know?

If you don't know what you're doing, don't involve others.

Since I don't quite get the point you're making here, I think I should specify that I was playing the role of someone who wants to start up a website on the side but isn't an expert on computers, networking, software development, or international privacy law.

I know plenty of people with a get rich quick scheme to sell widgets, but who don't know the difference between WordPress and Microsoft Word.

Expecting them to know that starting a website with a plug and play webserver could collect sensitive information on their behalf is pushing it a bit. Expecting them to know they have to comply with a law passed by a governing body they've never come within 1k miles of...

> I was playing the role of someone who wants to start up a website on the side but isn't an expert on computers, networking, software development, or international privacy law.

If you're not an expert, you have to get one. Same reason why you cannot just go and plan a non-trivial building by yourself when you're not a architect or civil engineer.

> > I was playing the role of someone who wants to start up a website on the side but isn't an expert on computers, networking, software development, or international privacy law. > If you're not an expert, you have to get one. Same reason why you cannot just go and plan a non-trivial building by yourself when you're not a architect or civil engineer.

This attitude is really sad to me. It was and is one of the greatest things about the internet, that pretty much anyone anywhere could publish something. If you now need an "expert" to do that, we've lost something.

Unfortunately, copy/pasting a formatted comment on HN doesn't have enough newlines to quote the post properly.

Anywhere you want one newline in your output, you have to use two.

While I agree, if you're an American setting up a plug-and-play site with chocolate chip cookie recipes, that happens to collect data out of the box, where along the process are you going to realize that you even need to know anything about EU regulations?

I've never hired a Wumbologist because I don't know what Wumbology is or where it applies.

Which is relatively easy when you’ve written the software stack powering the recipe site, or can at least grok its source (if available). It may not A) be clear to the operator of a recipe site that their stack is logging IPs and B) be reasonably straightforward for the owner of a recipe site to stop their software from doing so.

Some things are very deliberate, but others are the consequence of decisions far removed from those of site operators.

That's a very unlikely "solution" and is not going to happen unless the EU wants retribution in some form from the rest of the world.

As mentioned, this is the retribution. The US has been enforcing their laws on the rest of the world with equally radical methods for many years already.

I always found this interesting because surely no matter what effort you go through to prevent yourself from providing your service to EU citizens, you're probably going to collect enough information to be subjected to GDPR during the period where you did not remotely know a set of users were EU citizens. (e.g., those residing overseas, traveling, etc)

And then -- what if you finally have confirmation? You were attempting to avoid it, but now you cannot. If your attempt is to avoid it at all costs, you're effectively required to validate whether users are EU citizens much earlier in the process than before GDPR, which means GDPR already has had a big impact despite efforts to avoid its umbrella.

Despite the propaganda flying around HN for known political purposes, they can't and won't arrest you because there is no jurisdiction unless you have operations in the EU.