> Like most things, you need to comply with the laws of every country you do business in
How do you know if you are doing business in the EU without verifying the citizenship of the people who buy from you? If I'm selling a digital product, how do I know whether or not EU citizens are buying it?
You suggest below:
> As long as you don't target EU residents, you don't need to comply with the GDPR. Just don't advertise to europeans, don't talk about having european customers, don't ship to european adresses and/or don't localize to languages from countries where you don't do business.
This is the COPPA strategy, choice #3. It suggests that as long as you can pretend you don't know your customers are EU residents, it's fine to collect data on them. If that's the case, that's a much less effective law then we could otherwise have.
In regards to COPPA, you bring up the central problem yourself:
> COPPA is IMHO a flawed law, the general privacy protections should have just been extended to everyone. Age verification and consent validation were never going to work and it seems patently ridiculous to require companies to collect more data to protect privacy.
You're right, age requirements are a joke. We still don't have a reliable way to validate age without violating privacy. These types of laws only work if they're based on one of the three choices I listed in my post:
1. Universally applying the law to everyone, regardless of context.
2. Accepting that validation requires collecting and managing data, and being OK with the fact that we're going to collect and manage data to do validation.
or
3. Trusting consumers to self-validate and self-sort themselves.
The first option has sovereignty problems -- it doesn't work in a multi-nation, multi-state world. Even with something like COPPA, this strategy falls apart because a big part of COPPA is parental consent, and there's no way to universally apply a parental consent law. At some point, you have to decide whether or not you're going to validate the relationship between the child and the parent.
The second option is fine if you want to control your data, but means that we need to give up some anonymity -- maybe make a national database, or have some kind of proof-of-age or digital passport or something.
The third option is fine if you want to stay anonymous, but means that data protection laws have fewer teeth, because consumers will lie, which gives companies plausible deniability over violations.
What we can't do is have both 2 and 3. We can't say, "we won't require anyone to do any invasive validation, and also the validation will be really good and accurate." With GDPR, we either accept that many EU residents will unwittingly (or deliberately) do business with companies that are not beholden to GDPR, or we accept that businesses will need to validate the citizenship of their customers.
> How do you know if you are doing business in the EU without verifying the citizenship of the people who buy from you?
The GDPR lays out guidelines for what qualifies as doing business in the EU and it has nothing to do with verfying the nationiality of your customers (or doing geoip blocking). It has to do with the sorts of things I already explicitly mentioned such as advertising that specifically targets EU residents, localization into EU languages, shipping to EU addresses, etc.
> The first option has sovereignty problems -- it doesn't work in a multi-nation, multi-state world.
Why not? We have plenty of other types of regulation that differ between countries. Companies that wish to do business in multiple countries have to comply with all the laws for those countries. If you want to make a single car model that you can sell in two different countries, it has to meet both countries safety standards. If a company has no legal presence in a country, there is not much those countries can do to enforce the laws. (This last point is the actual weakness of these privacy laws and will have to be addressed by international treaties. This is an issue with enforcing rules in general (i.e. copyright) and doesn't just apply to privacy laws.)
> because consumers will lie, which gives companies plausible deniability over violations.
How so? At worst all this might mean is that consumers who choose to lie won't be protected. Plenty of other people would be.
A combination of #1 and #3 should work just fine.
Why? If you have decided to become GDPR compliant then you don't need to know which customers are EU residents. If you really want to know if some customers are not EU residents, you can ask them. There is nothing in the GDPR that requires GDPR residence to prove their residency before you must comply with the GDPR.
> "I'll just comply with every country, and that way I'll never need to figure out who my customers are."
Like most things, you need to comply with the laws of every country you do business in or face the prospect of penalties (which may or may not be enforceable without a legal presence in that country). This is nothing new.
> If you don't want to verify, you can just ask the person if they're European and block them if they say 'yes.'
You could, and some companies have thrown a hissy fit and decided to do location based blocking when there is no evidence that this is sufficient or necessary to indicate that you don't do business in the EU.
This isn't strictly necessary. As long as you don't target EU residents, you don't need to comply with the GDPR. Just don't advertise to europeans, don't talk about having european customers, don't ship to european adresses and/or don't localize to languages from countries where you don't do business.
> In the US, the most direct analogy here is COPPA. COPPA is a set of privacy restrictions for what information can be collected about children under the age of 13. There are traditional ways you can fall foul of COPPA (some sites are just obviously targeting children). But for the most part, the US went with option 3 -- you ask people their age before they sign up for your site, and you block them if they're under 13.
This is not very accurate. COPPA covers more than just what data can be collected. It also has provisions that require the ability to opt-out of the data being shared with 3rd parties and provide notices that clearly detail what your and 3rd parties will use the data for (and who they are and what they do). Additionally, COPPA requires parental consent to collect this data.
COPPA is IMHO a flawed law, the general privacy protections should have just been extended to everyone. Age verification and consent validation were never going to work and it seems patently ridiculous to require companies to collect more dat a to protect privacy.