Re:Silicon Valley is terrified of California’s privacy law
by shkkmo on Friday September 20, 2019 @07:50AM
(#21025576)
I am not circling around the point, you seem to have an incomplete understanding of both GDPR and COPPA that are leading you to make unwarranted assumptions such as:
> How do you know if you are doing business in the EU without verifying the citizenship of the people who buy from you?
The GDPR lays out guidelines for what qualifies as doing business in the EU and it has nothing to do with verfying the nationiality of your customers (or doing geoip blocking). It has to do with the sorts of things I already explicitly mentioned such as advertising that specifically targets EU residents, localization into EU languages, shipping to EU addresses, etc.
> The first option has sovereignty problems -- it doesn't work in a multi-nation, multi-state world.
Why not? We have plenty of other types of regulation that differ between countries. Companies that wish to do business in multiple countries have to comply with all the laws for those countries. If you want to make a single car model that you can sell in two different countries, it has to meet both countries safety standards. If a company has no legal presence in a country, there is not much those countries can do to enforce the laws. (This last point is the actual weakness of these privacy laws and will have to be addressed by international treaties. This is an issue with enforcing rules in general (i.e. copyright) and doesn't just apply to privacy laws.)
> because consumers will lie, which gives companies plausible deniability over violations.
How so? At worst all this might mean is that consumers who choose to lie won't be protected. Plenty of other people would be.
> How do you know if you are doing business in the EU without verifying the citizenship of the people who buy from you?
The GDPR lays out guidelines for what qualifies as doing business in the EU and it has nothing to do with verfying the nationiality of your customers (or doing geoip blocking). It has to do with the sorts of things I already explicitly mentioned such as advertising that specifically targets EU residents, localization into EU languages, shipping to EU addresses, etc.
> The first option has sovereignty problems -- it doesn't work in a multi-nation, multi-state world.
Why not? We have plenty of other types of regulation that differ between countries. Companies that wish to do business in multiple countries have to comply with all the laws for those countries. If you want to make a single car model that you can sell in two different countries, it has to meet both countries safety standards. If a company has no legal presence in a country, there is not much those countries can do to enforce the laws. (This last point is the actual weakness of these privacy laws and will have to be addressed by international treaties. This is an issue with enforcing rules in general (i.e. copyright) and doesn't just apply to privacy laws.)
> because consumers will lie, which gives companies plausible deniability over violations.
How so? At worst all this might mean is that consumers who choose to lie won't be protected. Plenty of other people would be.
A combination of #1 and #3 should work just fine.