You should ask an attorney, not take random advice from the internet.

But since you asked, here’s some random advice that HN will hate but can’t refute: you should ignore it. You shouldn’t misuse user data, but that’s always been true. But you shouldn’t worry about the latest laws or regulations from any countries that have no effective jurisdiction over you, even if they claim to. If New Zealand sees a blog post of mine that they dislike and sends me a bill for a $100 fine, it’s going straight in the garbage. There’s nothing they can do. Same with the GDPR.

Don’t misuse user data, ask an attorney, you’ll be fine.

Frankly, I don't really collect user data that isn't effectively public... I've run a telnet BBS and thinking of throwing it up again, and like most developers have a few ideas on creating something. I don't do metrics tracking, but might throw up something like google analytics, or even adds in a game/web-app.

In the end, I frankly don't even like using passwords, I'd rather just have users use SSO from one of so many provider options. One of my criticisms early on of FB is they didn't have an early option to JUST get the real name and email address of their users. That's all most of these identity providers should give... enough to shoot a notification email and know the name of the person.

In the end though, who knows... working on something now, I may comply as much as possible just to be nice. Exported data will only have hashed IDs of "friend" accounts, with everything else effectively public.

I generally try to do the right thing in what I do always. It gets harder in a politically charged society at large.

Honest hypothetical question... my file hosting website is in New Zealand, my servers are in New Zealand. Why would I care about US laws?

Asking for a friend.

Because the US will strong-arm the NZ govt into arresting you for piracy.

I think you mean that the NZ and US have both signed on to treaties governing copyrights.

I thought that's what I said - NZ being strong-armed by the US.

Strong-armed would seem to imply something other than "uphold your end of the treaty we both signed".

Can you explain to me the point of this comment? I'm too dense.

Look up Kim Dotcom/Megaupload.

The US and EU have a good relationship. The EU can (probably will) use international law to hold you accountable and the US is likely to comply.

EDIT: you is the hypothetical you. If the EU targets you then they will use international law to do so.

Enforcement in practice is almost certain to be "at the edge" with things like payment processors and ad networks that have direct business operations in the EU and are easy to demand third-party compliance from.

If you literally don't do any business with EU entities, even at arm's length, enforcement is going to be impractical and unlikely.

I also believe this. If you run a side project by yourself and you don't target EU users directly, but might have a few, it most likely won't be worth the effort to actually follow through on enforcement.

However, that seems like a very arbitrary line and governments love to waste money.

If you plan on doing business with EU entities at any point in the future there could be risk

Ha. You’re insane if you think that the US Congress is going to start letting 28 agencies in the EU start fining small businesses that have no EU presence whatsoever. The political ads write themselves.

I guess the question is what does the EU value more, privacy or their relationship with the US?

I don't have an answer but I suppose we'll find out soon enough.

I have an answer: no way is the EU going to cut ties with the US over this, and no way is the US going to let the EU trample their national sovereignty by letting regulators start fining small businesses with no US presence because some EU citizen sent their data INTO the US. That’s ludicrous.

yeah.... that's gonna happen

You shouldn't, unless you plan on doing business in the EU.

if you don't deal with EU customers (like if you don't sell ads to EU advertisers), you don't have to.

Look at it this way: "my website is in the EU, my servers are in the EU, why would I care about DMCA?" The truth is that if a company had a way to discriminate their EU users without any possibility of failure they could only apply these things to them but that approach has proven to not be cost effective.

You do realize there's a difference between a law and a treaty and there are international treaties governing copyrights, right?

https://en.wikipedia.org/wiki/International_copyright_treati...

I'm not aware of all the details, but is the answer to your question "you wouldn't"?

Does your website serve users from EU region or do you intend to block incoming traffic form EU? If you serve them then you might want to collect some data points about them. It is like being on the internet you are by default given a chance to operate business (website in this case) in whatever country a user access your website from. You are not going to open a franchise in Germany and not abide by their local laws concerning about German shoppers right?

This is an insane argument. So now by having a blog, I’m under the jurisdiction of 200 countries and countless other small jurisdictions? What happens when they all contradict each other? Or when I can’t tell what jurisdiction a user belongs to? Or when they pass crazy laws like anti-blasphemy or demand half my revenue, or whatever?

I don’t think you’ve thought this through.

> So now by having a blog, I’m under the jurisdiction of 200 countries and countless other small jurisdictions?

Guess what? You already are. For example, if you insult the Thai king on your blog and you visit Thailand you can be prosecuted. This has happened.

Of course, you can't be extradited for this. But if you are a notorious online controversialist you should be careful where you travel.

There’s a difference between actually being under the jurisdiction of a government and them claiming that you are. My contention here is with so many people claiming that I should care as a matter of morality or something. That the EU’s claim here is right and just. Under that logic, so is Thailand’s. Is that really the world we want?

Obviously if the EU has some enforcement mechanism, I should be cautious, even if they’re in the wrong (like Thailand). But they don’t have any actual enforcement mechanism, so this just seems irrelevant to me.

So, you're saying if someone from Saudi Arabia sees a German website that shows a woman's bare knees, that the German site will have to pay Saudi fines?

The fans of this law seem incapable of separating its intent from the practical realities of the underlying principle it introduces. Namely, that every website on the internet is now subject to any laws by any jurisdiction in the world (down to the city level) because some subject of that jurisdiction might visit their site. It’s insane.

Fast Forward 10 years: "and that's how decentralized internet was born"

Did you just compare a data privacy law with some hypothetical obscure privacy law? Amusing. Per your analogy, if German website still wants to be shown in SA then either they get SA govt on board with w/e content they are serving (bare knees in this case) or they stop traffic coming in from SA altogether or they simply comply with SA local laws and censor content (bare knees). You should do some research on how US based website show content in Chinese region.

That's China doing the blocking... You're saying I should have to perform custom work for a legal case that I'm not under jurisdiction of.

By any means I am not a fan of GDPR.