> they don't know any better

There is a ton of literature about how it should be done, there has been enough press for anyone to be aware that it's a serious subject that needs to be studied, and small companies will often consult with external legal advisors because they can't afford to get on the wrong side of the law on this aspect.

I've participated to a ton of these discussions in small and big entities, basically everytime a new service is launched or significantly changed.

In my opinion it's pretty close to handling your finances: you don't go through all the hoops to pass you holiday rental as expenses just because you didn't know better.

> because they can't afford to get on the wrong side of the law on this aspect.

Conversely, some can't afford to get on the right side of the law on this aspect. In our case, we had ~15 customers in the EU (out of ~2000), totaling $2,000/mo MRR. After talking with our legal counsel, we decided to exit the EU market entirely. Our business model was a simple niche B2B SaaS. We never sold, shared, or traded any data of any kind.

When we fired our EU customers, they were very upset! They assumed we were doing something "shady", which wasn't the case at all. The regulatory burden simply wasn't worth the relatively small MRR. The quotes provided for a third-party DPO was higher than our revenue in the market, and the only other option was for me (an overworked founder) to take on that role, and I valued my time higher than that MRR.

Those customers lost out, because after we exited, so did every other player in our niche. Nobody wanted to deal with it.

Cool! Care to share the niche?

P.S.: no opportunity is lost. There is always someone else who seizes it. :)

"P.S.: no opportunity is lost. There is always someone else who seizes it. :)"

I'm sure these corporations want a random person in HN to provide service to 12 customers?

It's false to suggest that material barriers to providing services are only contextually relevant. It's a permanent tax and it's real.

Is there no open source effort to make this easy? Or is it one of those instances where people want to do it but don't want to take the legal stands (which is completely understandable).

Edit: Also if you are not selling/using this data, why can't you remove everything but session cookies? Please note I'm not a web developer so the answer can just be because it's too much work.

For us, the issue wasn’t a technical one. It was a human one. Our lawyers said we had to appoint a “Data Protection Officer” who’s job it is to respond to requests from EU persons to delete their data. We were a small company and everyone had enough on their plate as it was. Adding more work to keep <1% of revenue wasn’t worth it.

I think I can count on one hand the number of right-to-be-forgotten requests the team I work with has ever received in the last three years (with 15x the users). We've had a couple more subject access requests than that, but we'd already shipped pretty comprehensive self-service tools for retrieving data that met the vast majority of our user's needs. This doesn't seem like an unreasonable thing to expect a service to offer, IMO.

I would argue that the duties of a DPO is not more work than a small company could handle and indeed, it's slightly odd to me that a small company would think that a small handful of data erasure requests or subject access requests are a) somehow difficult to do given 30 days notice and b) somehow consume more time than the profit left over on $24k revenue buys?

Most companies here in the UK just take it in their stride and have no problems complying.

Unsure of how you extrapolated the total number of users from my previous statements. We were a B2B SaaS where our customers each served 10,000s of end users, who also had access to our platform with their data stored within. In aggregate we’re talking 25mm+ total users in my case.

At the time, being that the DPO role was new we didn’t know how many requests to expect. And while the law may allow for 30 days, our customers wouldn’t take it well if it took us longer than a couple days (our customer service SLA was 24 hr first resolution time). Their customers would complain to our customer who in turn would complain to us. If we make our customers look bad, we hear about it loudly and clearly.

To each their own, I suppose. From my perspective as an overworked founder, with a small team, growing at >200%/yr, we didn’t see the need to take on additional work just to maintain a very small revenue stream

I don’t fault companies for wanting to remain in the EU market, but for us, it didn’t make much sense at the time as our real growth opportunity lay in the Us/Canada (mostly due to consumer habits in the region).

I have no issue with the spirit of GDPR, and as a human, I support it personally. But, for my business at that point in time, it didn’t make economic sense to comply, so we left.

> Unsure of how you extrapolated the total number of users from my previous statements. We were a B2B SaaS where our customers each served 10,000s of end users, who also had access to our platform with their data stored within. In aggregate we’re talking 25mm+ total users in my case.

Doesn't that make you a data processor rather than a data controller - i.e. not at all your problem for your end user's end users?

> There is a ton of literature about how it should be done, there has been enough press for anyone to be aware that it's a serious subject that needs to be studied, and small companies will often consult with external legal advisors because they can't afford to get on the wrong side of the law on this aspect.

Companies relying on information from literature, the press and from external advisors is part of the problem.

All these parties often have motivations that are not necessarily 100% aligned with their clients. In the best case they are just overcautious because they don't enjoy the same protection as lawyers. In the worst case they sell GDPR products or profit indirectly from the sale of these products.

All that most companies need is advice from a lawyer that understands GDPR and acts in their best interest. That alone would kill a good deal of cookie banners.

> they require your login and therefore have your consent anyway (e.g. Facebook)

Requiring you to login doesn't automatically mean consent. In fact, the laws state that you cannot make consent a requirement for using the service. You can do login without needing any consent, as cookies needed for functioning of the site are exempt, but even if it wasn't the case, opting into some doesn't automatically opt you in to all.

> they can afford to skip Cookies because they have elaborate fingerprinting solutions

The law isn't actually about cookies at all and rather about tracking/storing. Things like localstorage are counted the same as cookies. I'd have to check the exact language, but I wouldn't be surprised if fingerprinting isn't against the cookie law too.

> they have legal departments that understand GDPR and protect them (e.g. GitHub)

Funny coincidence that you picked GitHub since pretty much to the day two month ago that they removed all non-essential cookies https://github.blog/2020-12-17-no-cookie-for-you/

No cookie banner is required for session cookies etc.

> - they can afford to skip Cookies because they have elaborate fingerprinting solutions

This is really just a special case of your last point. As far as I know, there is nothing cookie specific in the GDPR.

That's because the "Cookie Law", which real name is the ePrivacy directive, is separate (and predates) from the GDPR.

This directive defines in (24) [1] : So-called spyware, web bugs, hidden identifiers and other similar devices can enter the user's terminal without their knowledge in order to gain access to information, to store hidden information or to trace the activities of the user and may seriously intrude upon the privacy of these users.

The definition is broad. Does server-side fingerprinting solutions fits into it? Maybe not in the letter of the law, but at least in the spirit. Until a court decide either way, we won't know for sure.

[1] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...