"USA-based companies must follow it"

US based companies are not subject to EU law. The only reason a US based company might care about the the GDPR is if they have assets in the EU that the EU could seize. Other than that, we will happily ignore the EU's attack(s) on memory.

https://news.ycombinator.com/item?id=16965880

I would have preferred promulgating a set of standards to be GDPR compliant, and allowing companies the option to choose whether to conform. Individuals in turn could choose whether to use GPDR compliant services or not. Rather than hitting all companies globally over the head with a hammer. Eventually this strategy of legislative aggression is going to blow up in the EU's face.

That's the argument for why health codes should be optional, that customers can choose whether or nor to eat in dirty restaurants and the market will settle the issue. Nope. I don't want to play that game. I want everyone to obey a mandatory set of minimum rules.

It's about information imbalance. Without mandatory minimums it is too easy for businesses to hide faults from consumers. I don't want websites to use business judgment when deciding whether to protect consumer privacy. I want them to fear massive retaliatory fines should they not do the bare minimum necessary to protect the public from harm.

"I want them to fear massive retaliatory fines " is exactly why America/Asia is currently dominating Europe in technology. No start up and innovation can happen in such an outwardly hostile business environment

No startup or innovation should happen at the cost of harming the userbase.

You can take the good with the bad or have neither in some idealistic world where only one exists. You can even limit the bad (oftentimes limiting the good as well), but you shouldn't say in absolute terms that innovation with some bad should never occur even if there is significant good.

Ultimately it comes down to whether a user should be free to choose whether to use such a service. Ostensibly the user is receiving some benefit despite this "harm". If the harm outweighed the benefit there would be no user.

> I would have preferred promulgating a set of standards to be GDPR compliant, and allowing companies the option to choose whether to conform.

EU countries had data protection laws for years before GDPR. Moreover, GDPR is only partially more strict than the existing Swedish data protection laws. I cannot name a single company that gave a damn about these laws.

That's why GDPR, even with all it's ambiguities, is a good thing.

Ok? That companies chose not to conform is more indicative that consumers ultimately didn't care very much.

Nope. It's only indicative that companies think they are entitled to not give a damn about any European laws.

Absolutely not. GDPR is the kind of thing that should have been passed worldwide 20 years ago. If companies will not respect your data and your privacy, they deserve to be punished severely.

It's amazing how clueless some people are about the damage that regulation that isn't well thought out can cause to small businesses.

GDPR isn't a well thought out regulation because the regulators couldn't even take the time to give examples of how to to migrate common internet infrastructure in order to be compliant. Instead they just threw out their shitty law and told the world to figure it out.

This new link tax further proves to me that the bureaucrats in the EU have no idea what they are doing and have no technical knowledge.

Just because you are small, doesn't mean you get to abuse user data. No, parent is right, this is long overdue, and if a few data abusers must pay, so be it. Its too important to make exclusions for those that cannot keep up. If you can't stand the heat, get out of the kitchen.

>If you can't stand the heat, get out of the kitchen.

And that is the goal, isn't it?

To drive out smaller competitors from online spaces so that only the big boys can play.

It's amazing how clueless some people are about the damage that software that isn't well thought out can cause to its users.

${SOCIAL_NETWORK} isn't a well thought out business because the owners couldn't even take the time to consider common privacy expectations in order to respect their customers. Instead they just threw out their shitty service and told the world to figure it out.

This new practice of blocking EU users further proves to me that the execs in ${SOCIAL_NETWORK} have no idea what they're doing and have no good intentions.

A fundamental right to remuneration for your creative work that can’t be signed away is in exactly the same spirit as a fundamental right to privacy that can’t be signed away. In both cases you start with a legal protection that’s good and necessary in some cases, declare it a travesty that people are signing away that right en masse against the EU’s opinion of their best interests, and close the door to that sort of contract. In both cases this flies in the face of established internet customs, so you shrug and say “in a society there must be rules, you can’t escape the law just because you’re on the internet and have gotten used to doing it.”

> fundamental right to privacy that can’t be signed away

If you're talking about the GDPR, from what I understand you can sign your privacy away. What can't be done, is to require you to sign your privacy away as a condition to use some service, unless there's no way to provide that service without using your personal data.

And this is how power hungry people/organizations throughout history have implemented disastrous policies in the interest of the "greater good".

It’s also how and why pretty much every law in the history of humanity gets written, so singling out only the worst examples doesn’t really say if it is our worst tendency or our best.