Even in tourism there is some level of cross-border law enforcement, especially given international treaties.
So to me it makes sense that a company that wants to take money from (or even to serve content to) people in country A need to respect the laws of country A as a general rule.
Of course, the people of a company should be free to do what they believe is right, such as not upholding unjust laws. The law is not an excuse from moral duties. So I have no problem with companies flouting censorship or even copyright rules. I also don't have a major problem with companies enforcing somewhat benign censorship rules (by taking down content, not by going against individual users), such as imposing certain public decency laws (e.g. no swearing, even no blasphemy) when serving content to countries that prohibit this kind of behavior.
On the other hand, closing down accounts or giving over information about people who have broken those laws to regimes that may punish them brutally should not be taken lightly. You can scrub messages denigrating Mohammed from Saudi Arabian YouTube and that can be argued as respecting the tastes of your Saudi Arabian visitors. But that does not mean that it is also acceptable to report a user that made such a comment to the authorities there, knowing that they may be severely punished. In fact, scrubbing the comments could even help protect the individual who made them from the authorities enforcing the unjust law in that country.
The world is a subtle place and trying to apply simple rules to moral and ethical questions is a fool's errand.
I disagree with this. I have an open port at 80 and 443 and whoever wants to connect to it can do so. If my server is physically in the US, it only needs to obey US laws. If someone is violating their country's (weird) laws by visiting the server, that's that person's problem.
It's not my job as a developer, website host, or business owner, to for example ink out photos of women because Saudi law requires that. It's not my job to remove references to the Tiananmen incident. Those countries can, if they would like to, censor my website at their borders with a firewall, I don't care. It's not even my job to track down where your IP address is physically located. I couldn't care less about your IP. You could be using a VPN, for all I know.
Iran or China has issues with my website? They'll block it. Problem solved. I don't have to think about it too much. They do the work for me.
EU has beef with my website? Go ahead, you block it too, I don't care. I'll grab some popcorn and sit back and watch how your citizens react. (hee hee)
> And much more uncontroversially, if you are accepting payments from someone in another country, then you are definitely doing business in that country.
I disagree with this, as well, if those payments are coming from individuals and not businesses. If an individual in Germany flies over to the US and buys something from me, they are subject to US laws in that transaction. They are subject to German laws when they take that thing back. But in NO part of the entire process am I subject to German laws.
That doesn't change if "flies with an international flight" changes to "travels virtually via an international TCP connection".
That is not at all clear. In general, the place where I physically stand is the place whoze laws I expect to be affected by, in any transaction. Of course, this is also true of you sitting near your server, so there is a conflict.
Also, I suspect international commerce is more complex than that, and that if there were a conflict between German laws and US laws on the consumer's rights in your example, the German laws might have some power against you (well, probably not with the US specifically).
Granted, if significant revenue is generated they'll have to exist officially in one place or another in order to report the income, but not all such sites would need to generate such income, and could forgo it specifically for the purpose of violating local regulations in some cases.
But if you're in the US, and your servers are in the US, you shouldn't have to obey European laws. European site visitors are no different than physical European tourists in the US; the owners of those US museums and tourist sites don't need to obey European laws just because they have European visitors.
That’s what customs and border control is ultimately for: to ensure that goods being imported are compliant with local laws. In the case of data, this means national firewalls— something that would fundamentally change how the internet works.
But as a website host, I don't have to do anything.
Alcohol is illegal in Saudi Arabia. A Saudi citizen is free to buy alcohol during their visit to the US. They just can't take it back home of course. But the liquor store they visit in the US doesn't need to change their policies for that one customer, and doesn't even need to know which country their customer is from.
In practice, I think I would prefer the latter, even if it is less clear and purely logical. I mean, the US is railing against inquiries over war crimes this week. Though that particular action is entirely irrational, it seems unlikely that the USA would enforce GDPR on the behalf of the EU short of a very large company violating it flagrantly. If I run a local nonprofit in the US that serves the elderly of my community, and the EU-resident child of one of my clients donates to my organization, by which I wind up collecting their information--repercussions seem frankly very unlikely. Firstly, I doubt my non-profit would be pursued for such a violation by the offended nation, as they do have optics to maintain. Secondly, I have no physical presence in their jurisdiction against which to enforce the regulation, so my own government would have to enforce it on their behalf, which currently seems unlikely to me (though I'm not an expert on such things by any means).
Depending on their specific activities (information collection, in the case of GDPR); whether or not they are physically present in the jurisdiction of whatever regulation; and their home country's foreign relations with the foreign government who originated the internet law, a company can choose to comply with foreign internet law--or not--at varying degrees of risk. As messy as it is, this seems better than firewalls to me.
Perhaps explicit agreements with foreign governments are needed in this area. That seems preferable to firewalls, arbitrary risk-taking, or mindless compliance with a foreign law.
Honestly an app only needs to operate out of one country. To have users in other countries, all that is needed is an open TCP/IP connection and a cross-border payment system (e.g. PayPal, bitcoin); it is not necessary for them to operate a local business entity, which would mean that they should not be subject to local laws.
Although this may be an unpopular opinion, and given the HN climate it's likely I'm going to get downvoted to hell for saying this, but I personally think the same should be true of GDPR. GDPR is an EU law and the EU has no right to impose its EU laws on the US or anywhere else. Neither does China. It doesn't matter if the laws are good or bad laws -- laws should stay within their jurisdiction. Letting the EU have their way is a slippery slope of a precedent for other countries who may have less-noble laws they want imposed on the US.
(That said, the US can implement its own version of GDPR for US businesses, but US businesses shouldn't be subject to EU laws).