[1] https://en.wikipedia.org/wiki/Fahrenheit_451_(disambiguation...
It's legitimate in the same way that '451: we want to load up our site with so much javascript your computer catches fire and burns your house down, but that's illegal in your jurisdiction so this site is Unavailable for Legal Reasons' is.
To me 451 is like 404 (nothing here) and 410 (was something here but now there isn't) - it's a further progression/specificity to 'was/sort of is something here but it's not presently available for legal reasons'.
Common obvious one is DMCA takedown notices, but it might also be an injunction, or even accidentally published while still under embargo - or deliberately to prime SEO (not advice) - or NDA, etc.
Project Guttenberg in Germany (and The Pirate Bay in the USA, I think) would be 451.
It’s not something to be proud of, but it is something I am sympathetic about. Modern laws (not just GDPR) are long and the language is often hard to understand.
I believe that laws must be simple enough to comprehend, or else they will not be comprehended and thus will be violated even by people who want to follow them — the phrase would be better if it was “ignorance of the law cannot be an excuse”, because that works both ways.
It's an approximate and somewhat mythical value, popularised by Ray Bradbury's novel. Actual ignition point varies bu 100+ °F. Experience this past year with sourdough baking --- on parchment paper at 290°C (550°F) --- shows that though the paper browns, it does not combust. (Possibly affected by thermal mass / moisture of bread loaf.)
https://slate.com/technology/2012/06/ray-bradbury-death-does...
</pedant>
In practice, you need a consultant and maybe a lawyer to help with the paperwork and that's assuming all the processes are basically in compliance.
If you are not in Europe, the main thing that determines whether or not GDPR applies to your site is Article 3 of the GDPR, "Territorial Scope", and the corresponding Recitals.
A big factor there is whether you are offering goods or services in the Union, irrespective of whether or not users have to pay. Mere accessibility from the Union isn't enough to show you are offering things in the Union. What matters is whether or not the site "envisages offering services to data subjects in one or more Member States in the Union".
There are several things that can show you are envisaging offering in the Union. Having localized versions of your site in languages that are used in the Union but not in your own country, accepting payment in Euros or the national currencies of Union members, targeting Europeans with ads for your site, and many others.
If you aren't doing those things, it gets more subjective. If your site should be of no interest to Europeans, and you don't expect to make any money from whatever Europeans happen to somehow end up on it, it is simplest to do a geoip block on Europe. That should conclusively establish that you do not envisage offering services to people in the Union.
In practice, if you don't have high visibility (i.e are small enough, which probably means 90% of websites) and don't have any presence in the EU then just ignore GDPR because no-one is going to go after a website on another continent because it tracks visitors and sometimes people from the EU visit it.
1. the legal tools to make Spotify not lockin ones personal content and 2. Read some random article on the internet where the publisher actively does not want to protect the readers privacy
then I think I know what price I want.
But unless they all adopt the same one, the requirements will all be different, which means they'd each have independent compliance costs, which means local news providers like this will still block everybody outside of their own jurisdiction so that they only have to pay one set of compliance costs instead of sixteen or a hundred.
I'm not trying to be combative, I'm legitimately asking: what alternatives to Spotify are there?
It's really not a big deal and yes if the tradeoff is that forcing the web monopolies into consumer friendly behaviour means that some tiny services are region limited (in name, not necessarily in practice due to vpns) then it's a net good.
This is, as a general rule, catastrophically worse. Because then the only parties with input into the rules are the largest organizations who can successfully lobby an inter-governmental body and they (unintentionally or on purpose) promote rules that work for the largest organizations and annihilate smaller ones.
It also tends to make the rules much more complicated, because each of the individual jurisdictions have their pet issues they want to graft onto the unified system, so now instead of having some obscure and poorly conceived rule only applying in Russia or Egypt, it ends up on page 641 of the unified rules.
Compare this to some kind of rational system where the rules that apply are those of the jurisdiction where the server is located and then if you don't like the rules in Iran or California, you use the services hosted somewhere else. And the services that really are targeted at your jurisdiction end up locally-hosted anyway for the efficiency advantage unless your jurisdictions rules are so oppressive that they overcome it, in which case "Chinese dissidents use servers in the US or South Korea" is a valuable release valve.
And if you're fine with people using a VPN to use services that don't comply with their own jurisdiction's rules anyway, you should be fine with that. Because the only difference is to deprive the majority of their agency if they can't figure out how to work a VPN.
You don't know that. They may take privacy very seriously, but don't see any point in risking possible GDPR issues, especially if they get no income from people in Europe.
however, a lot of "small", local news organisations are actually owned by huge (multi-national) corporations. they might work hard to preserve that small appearance, but do have a reason to fear the GDPR.
Because as you said yourself, they're part of a large organization that DOES do business with Europe, but that part of the business doesn't get any money from Europe, so there is no reason for that part of the business to go to the effort of complying.
you said "local news organizations", and i was simply pointing out if that is what they truly were, they wouldn't have to comply. so i think we agree?
It would be a great service to everyone if the EU could clarify which type of sites do not have to comply. Otherwise, you can hardly blame organizations that it would be cheaper to block EU traffic than even just to pay a lawyer to try to figure out of GDPR is applicable.
And I definitely don't blame organisations blocking EU traffic; it's at least an honest admission they won't protect your privacy. (Although it may not be a decision of the site itself, I'll get to that in a second.)
Recital 23 is spot on though. Can a New Hampshire-based local news site be said to offer goods or services to members of the Union? It sure sounds like you could say "no" in good faith (which is a defence, IANAL etc).
Can the same be said for either a huge multi-national, or trackers and ad-flinging networks a local site might use? Probably not...
While it's never been tested, there is a good chance the USA would cooperate with an extraterritorial prosecution, and so it's easier to just avoid it altogether by blocking Europeans.