As an EU citizen (until April, anyway), can I live in that future please?

One could try enacting clear restrictions that do not require a team of lawyers to divine a meaning, and one of lobbyists to make sure the meaning is correct. You can write regulations that take intention and unlawful gains into account. And, finally, you can get somebody that understands the subject to tell you what can actually be done and what is sci-fi.

But it seems that lawmakers worldwide consider themselves above that kind of concern.

Of course there is. You just add a minimum scale requirement before these obligations kick in, so they only affect sites that are big enough both to cause significant problems with illegitimate uploads and to have the resources to do something reasonable about it. Laws are written like this all the time in places with more sensible legal cultures, but the EU is infamous for not understanding why that is useful, and that brings us back to quanticle's point.

This is what I'm referencing in my last sentence, "Even attempts to target legislation tend to have an unquantifiable ripple effect beyond the foresight of naive legislators." This naive view doesn't respect the intertwining nature of businesses of all sizes that work in the industry nor does it take into account the chilling effects on growth (the latter being less of an issue). Small businesses lean on larger ones that might be targeted in a myriad of ways including infrastructure, standards, software, employment, acquisition potential, marketing, etc. Targeting them is like targeting me and to say "only affect sites that are big enough" is part of the classist dialog that too often exists in a utopian vacuum that assumes all results are the exact representation of their intentions.

The principle that some things are too small to be concerned about is a long-standing legal tradition, hence de minimis and so on.

In my own country, the UK, many rules do not fully apply to very small businesses and various extra allowances are made financially, precisely because imposing the same rules on a five-person start-up as a 2,500-person international corporation may be disproportionate.

There is nothing at all unusual or naive about this. It's done all the time. It's just not something the EU in particular has ever been very good at understanding or dealing with. For example, by their own admission, several of the key officials involved in the VAT changes a few years ago literally did not realise that many thousands of microbusinesses that would also be covered by the new rules even existed, nor that the new rules would essential cause them to not exist any more. The new copyright regime we're talking about here is a different context but still has the same underlying problem.

Right, and that's why laws should be worded to minimize the time and resources required to comply with them. Laws like GDPR and Article 13 are like a nominal tax on every business. It's easy for Google and Facebook to throw a few million dollars and a few thousand engineer-hours to take care of compliance with this stuff. It's much more difficult for a 10-person startup with a fixed runway.

Saying "It just takes time and resources to deal with that," is a vacuous statement. It takes time and resources to deal with anything, no matter how large or small. The key factor is how much time? How many resources? And finally, how do the time and resource requirements compare to the time and resources you have on hand?

> Genetics regulations, while I absolutely realize their necessity, have made it difficult for me to expand my side business into the EU. This would just be another road block for innovation.

When I look at GDPR I see a safeguard against mass surveillance and dystopian add ruled societies.

The "consent" popups you see on loads of websites these days actually run counter to the GDPR because they usually opt-in by default or tie consent to uses for which that consent is not necessary. They also rarely provide detailed information about what data is used and what they do with it.

The point is that there may be multiple lawful bases for collecting the same personal data and it may be used for multiple purposes. The fact that consent was one of those bases does not necessarily convey a right to erasure if others still apply after consent is withdrawn.

Moreover, given that one of the other lawful bases for processing is the infamous "legitimate interest" umbrella, which could cover almost anything or almost nothing depending on subjective interpretation, the whole situation is quite ambiguous.

In the end the big companies win and the individuals lose.

That's how other industries are run nowadays. I'm not saying it's a good thing, but that rather this does not come from cluelesness about tech, but more about bringing tech into the legislatory mainstream.

Youtube's filter removed the audio track from a video of mine that was essentially silent to start with. There was certainly no music, TV, movie, etc... in the background.

[1] https://en.wikipedia.org/wiki/4%E2%80%B233%E2%80%B3

Here's the video for the curious:

https://www.youtube.com/watch?v=wCEjJhm8qYM

There is someone with a financial interest in not having people watch it, but removing the audio won't help them.

That aside, the bill is designed to target "the big ones" because publishers want to gain access to profits from advertising. You just need to look at the people who initiated this tragedy.

I hate it that people don't talk about what problems the law intends to solve. You will be able to quickly reduce the answer to special interests. At that point, a legislative process should stop immediately. Will be interesting if the european institutions are able to do so.

What these rules do is destroy user generated content. Because your external HD can hold every Hollywood blockbuster in the last five years but it's nowhere near big enough for all the user generated content on YouTube.

A properly decentralized system can comply with the laws as well: you know what you put up, so there is a filter - it's just in meat space.

I think the bigger issue is that many YT creators rely on its ads for revenue.

1 - https://joinpeertube.org/en

YouTube's uploads filters don't work very well with Peppa Pig episodes that have been chopped up into 45 second pieces and reordered randomly.

FYI, "allowing EU users to opt-out" is still wrong, they would have to explicitly opt-in to targeted ads. At least, in so far as ads are targeted based on personal data.

For the record, your EU representative isn't required to be a lawyer or even legal expert, though.

https://news.ycombinator.com/newsguidelines.html

But how does one avoid asking every time when cookies are blocked? What other implementation option is possible? This is what cookies are for.

Local storage? Detect if cookies are blocked? Or, simply don't use cookies for purposes other than providing the service - which exempts you from the need to show the message?

This, or as a minimum: Don't track people who has the DNT header set.

But yes, the userbase for those is so small that we can assume that people with the header on simply don't want to be tracked.

These intrusive popups and banners, on the other hand — especially the new post-GDPR in-your-face ones which I have to dismiss before I can even read a simple article — have ruined the user experience of the web. And my ad blocker doesn't seem to be able to block them.

There's a lot of hand wringing about tracking but what harm does it actually do?

Edit: I see somebody chose to express disagreement via mouse rather than keyboard. Interesting.

PS: I didn't downvote, I never do - I'm a downvote-hater :-)

Yes, it is. Although we're constantly updating the code, my team's responsible for a web site for which the data model is nearly a decade old. And the overall business process that it feeds is about 25 years old. We don't know everywhere that the user's data goes in order to export it. Building the support to do so is pretty big. And being able to expunge their data on request is huge, given that data models were constructed without thought to a requirement that the user data be purgeable. It turns out that the requirement isn't quite that broad, but then the legal advice to help determine where it does need to be done isn't cheap.

Strong added value to who? If Google Analytics disappeared tomorrow do you think the average internet user would be at all impacted?

Remember, GDPR is about protecting the user.

For example, do email addresses on the comments on a blog site fall under that protection? If so, there are some agencies in charge of enforcing GDPR that are violating GDPR on their sites...

THat doesn't mean you can't use email addresses without asking; ie if the comment system uses emails to notify people of replies or moderative actions, then it's totally legit to collect it for exactly this purpose.

You only need consent if the personal data collected isn't strictly necessary for the operation of your site, ie if you use tracking cookies and sell emails to advertisers.

That is not unclear at all. They absolutely do.

That doesn't mean you can't have them, but it means you need consent, you need to be clear about how you will use them and you need to let people withdraw consent.

A reasonable person who is even minimally informed about GDPR will know that an email address is covered by GDPR, hence it is "clear".

I want to emphasize - you can be right or wrong about the GDPR, but that's not the same thing as being right or wrong about whether people are confused by it.

I think it should be obvious that debating feelings or perceptions or emotions of other people tends to lead to unproductive interpersonal interactions, but perhaps others have not noticed this phenomenon. I can't imagine winning a debate with someone over whether they are trolling or not. Even if it's really obvious, nobody can see inner motivations for sure.

At the point where one can prove that one part is too (trollish || stupid) I think it is reasonable to limit how much we care about their opinions.

It's not about e-mail addresses. It's about personal information. It's not about what data you can have. It's about how you can use data.

You don't own my personal information, I do. If I give my information to you, you can only use it in whichever ways I consented to when I gave it to you. If you want to use it for something else, you need to ask me again. And you can't just give me a blanket CYA contract to sign just so you can decide later.

This is precisely how it would work in normal everyday social interactions. If I go to a Mom & Pop shop and give them my number so they can call me when my favorite brand of soup is back in stock that doesn't mean they can call me to tell me about random new stuff they carry or give my number away to someone else.

Personal information is owned by the person it is about. It gets murky with aggregates (but the GDPR helps you figure out which ones are still considered personally identifiable) but it's blindingly obvious for things like "enter your e-mail address".

Do you have an e-mail input in a contact form? I'm going to assume that'll be used so you can respond to me although it'd nice of you if you say that explicitly right there on the form. If it's a comment form, why do you need my address? Who will it be shown to? What are you going to do with it? Where will it be stored and how can I tell you to delete it later? That's why you now need to think up a Privacy Policy: these are questions you always had to answer for yourself but now you're legally required to make conscious decisions about this.

Is this too much of a hassle? That likely means you didn't have any good reason to collect that information in the first place. Great! Personal information is a liability and it's better to collect less of it than more. Although that may disappoint future Zuckerbergs, collecting people's private information (even if they give it away voluntarily) imbues a lot of responsibility on you if you don't want to be completely careless. And the GDPR is an example for a policy that gives that responsibility teeth and punishes companies who are careless.

You don't want to store passwords in plaintext. You don't want to hoard credit card details or medical data. Personally identifiable information is no different. The GDPR just provides ways for you to store and use that information legally, in addition to reiterating that privacy and control of your personal information is a human right.

I'm sure there will be a significant price tag just for training people to be compliant with it.