The only time I've got into issues was with an american firm using an american law (dmca) to attack me (a non-american) and my hosting company (a non-american hosting company)
[edited with less anger]
Here we go again.
The GDPR has no problem AT ALL with cookies. Use as many as you like with no need for popups. However, if you are using cookies to track or personally identify me, then you need to ask my permission to do so. And so you should.
The amount of misinformation (some of it wilful) circulating about the GDPR on HN (a technical forum!) is shocking. If you consider yourself a professional developer then I strongly suggest you read a GDPR primer. There is no excuse not to. Following the GDPR will simply make your code safer when handling personal data.
Can you share your website/service?
But if you want an example of a fully featured public site which doesn't need cookies
Load that in lynx, which asks for every cookie, and none are set.
Now sure, if you choose to log in, then functionally you need to accept the login cookie, but that cookie isn't spammed out to you.
Under GDPR, a website doesn't need to ask for permission to have necessary cookies which enable core functionality such as security, network management, and accessibility.
I am not convinced this is true. See: https://law.stackexchange.com/a/32157
Also note that HN is likely in violation of this since there is no "Remember Me" checkbox when logging in. There is no indication that logins will be persistent.
The largest cost of GDPR is making that shift for existing companies. If GDPR ends up killing a few companies because of that, I personally don't mind. And if a startup doesn't end up seeing the light of day because it's not possible for them to operate under the conditions that GDPR imposes, then from my point of view the GDPR is doing what I'd like it to do.
> minimise collection
> anonymise things early
> remove data promptly when no longer needed,
> make it easy to audit what data you do hold
These (and others) are the costs I am speaking of. The vast majority of HN commenters will tell you that these costs are worth the upside in user privacy (which is totally fine!).
My point here is that the costs are not fixed. Over the decades we will see other, often sensible costs added to this list. While each individual cost may be small, they do accumulate and they influence who can and cannot start a business (or even personal website!) that deals with individuals from the EU.
Large companies will always be able to pay these costs. Some small companies may not. What you make of this is up to your personal interpretation, but I will miss the web of 00's where it felt like anyone could build a website or online business with next to no overhead.
The infrastructure to do analytics this easily does not exist - unless you expect a 65 yr old to trawl through Apache logs on the command line? Extrapolate that to everything from audits, logging, anonymization of data and of course it's going to push people to use centralized solutions.
From my perspective open source communities seem to have an ideological issue against analytics and business data, so very few solutions exist outside of big tech. What am I to do?
If it's "killing a few companies" and "a startup doesn't end up seeing the light" then "GDPR is doing what I'd like it to do."
That's a pretty shitty opinion to hold.
What did those companies and startups do wrong? I'm as tired of stupid startups as the next person, but I won't cheer for their failure unless they actually do something wrong.
Stop saving PII for profit/exploitation reasons and you're in the clear.
Well for one, they ignored users and the authorities asking them to stop their illegal data collection. No company is getting "killed" or even fined at all when they are not actively refusing to get compliant.
I often wonder about this. I mean, just the other day there was an article[1] here about sending GDPR requests to a health non-profit in order to sequence your genes for free.
The costs of each individual piece of legislation are small, but internet legislation only ever trends in the direction of "more of it". As more small costs are added (GDPR, cookie notifications, right to be forgotten, removal of Safe Harbor etc.) these costs will start to play a factor in who can run a web service and who cannot.
[1] https://news.ycombinator.com/item?id=27146975