As a European running multiple sites and services, you seem to have no idea what you're talking about. The EU rules are quite simple and easy to follow, and I love having real privacy protection from corporate interests.

I can see how reworking an existing system to be GDPR compliant can be a major headache. But for anything designed from the ground up the rules are really easy to follow and quite sensible.

Sure they are simple to follow. The question I have for you is how do you attract new customers?

Ads are still legal, that hasn’t changed. You can still target customer based on the sites the visit or the sesrches they make.

Sales people, well agencies, are just super pissed that they now have to do actual work. For years they’ve been able to make money by clicking around in AdWords and Facebook ads, now the real sales people has to get back to work.

By providing useful products or services?

As a company you need to follow the law. As a company, to attract new customer you sell something useful. Those two aren't mutually exclusive. For example, you can sell a service to a customer even if you respect their privacy.

A couple people here have said "make something useful." Fascinating. So make something useful but then how do you actually get it in front of people without resorting to very expensive and inefficient brand advertising?

Smaller companies have fewer compliance concerns and thus have an easier and cheaper job conforming.

As for the comment about "consolidation of goods/services into larger and larger corporations", that's very much an Americanisation. It's usually the American firms that go for global monopolies. I'm not saying we don't have large multi-nationals in the Europe as well but there is a real culture for supporting independent businesses here which I've not noticed in America (it might exist there but I've not seen it as prevalent there during my visits).

Frankly, the only people GDPR affects is those it's expressly there to protect us from. So I consider that a win.

The culture for supporting small businesses is a very fair point. Americans talk about it but in practice the support is very weak.

Europe also retains strong local press operations so advertising in newspapers is actually viable. That’s dead in the US.

I wonder what demographic is reading physical newspapers in Europe to cause a difference compared to the US.

The alternative being weak data privacy laws and the same consolidation happening anyway?

But yes, I'm fine with it. Compliance is really not that hard until you reach the scale of those same dominant players.

So you’re saying yes because you believe the consolidation is happening regardless?

Probably true in Europe. Regulation and taxation schemes are onerous there. Only the large can survive.

Big companies dominate much more in USA than Europe though, Europe has way more small local companies that compete with Amazon etc.

Absolutely a fair point. How do they get your attention though?

They play local ads? Google lets you advertise in an area, you see them in Google, in youtube, in facebook etc. And since these companies has much stronger local brand recognition than the American giants they win out in the local markets.

Also advertisements is more than just spending money, you need to mesh with the local culture as well. An American multinational doesn't really mesh well with most people and people reject their marketing, while local companies understand much better what the local people wants. In theory the giants could just hire locals, but in practice that has been really hard for them to do, as we can see every country has their own grocery store chains, brands etc.

But local ads without interest context are really no different than large scale brand ads. What's missing is the information about the users interests, which in turn makes the ads more relevant.

It is good that you are concerned, but EU is not lacking small companies. Where I live Uber is not the biggest ride sharing app for example, an European based competitor that started after Uber is bigger. They started after GDPR, so from my perspective it isn't EU that needs to fix its small businesses, it already works. It is USA that needs to prevent businesses from growing huge and dominating their entire market and effectively making it impossible for new entrants to appear.

Anyway, we can't refute all your points. It is really easy to just ask more and more questions, but at the end the results is what matters. And the real world results says that Europe is very good for small new businesses.

That's a very weird reading of that response. But no, that's not at all what I said.

I just read your edit. It doesn’t seem like I had a weird reading at all.

The companies consolidate in USA regardless of what Europe does, nothing Europe does will change that.

People saying that the laws are only there to ruin your business are mainly non-Europeans who have at most read a shallow blog posts on the topic, also written by non-Europeans.

The EU laws and regulations are quite simple to follow, and I dare say that it's much more difficult for those large corporations you mentioned because they usually have much more responsibilities. Smaller companies with a smaller scope do not have to worry about rules which do not concern them and their business.

So, to answer your question, yes, this is exactly what I want personally. For-profit actors need to be scrutinized.

But if the rules impact a smaller company’s ability to market against larger and better funded competitors isn’t that an issue as well?

Ultimately my question isn’t about compliance. That is relatively simple. It’s about the downstream effects.

The data privacy laws makes people think harder about the collection and usage of data. That’s definitely a good thing. What I don’t want to see is big corporations subvert that

But how do smaller companies function in such an environment without being subsumed into larger marketplaces?

The same way they have for the last thousand years?

Tech isn't magic. It's still just a business.

-

Lack of accurate targeting leads to lower ROI. If you’re trying to build a direct sales business that would seem to be a rather large impediment.

As an IT professional, I don't like it at all. The plethora of laws makes it much harder to do business in the EU: If you want to process any kind of data you are immediately forced to spend a lot of money on security certifications. This increased cost and velocity reduces the competitiveness of EU based companies which need to capture their home-market first. This is one of the potential factors why the EU loses out to other markets in startup-friendliness.

> If you want to process any kind of data you are immediately forced to spend a lot of money on security certifications

No, you don't

> This is one of the potential factors why the EU loses out to other markets in startup-friendliness.

No, it doesn't.

What it "loses out on" is on price dumping through unlimited investor money and wholesale private data collection

Do you actually work for a small to medium-sized EU business? Because I do and the amount of money we need to throw at compliance, both in direct costs and dev hours, is immense. And we're not doing ads, user targeting, or any other such "nasty" industry practices. Our product is widely thought of by both our customers and investors, as wholesome! But our product does require customer accounts and data storage because wheeling in a server rack to wherever they are is the last thing they want.

I used to be think GDPR was a good thrust for user privacy but years later what I see is an adorned web already suffering under the weight of its own crap super-adorned with these cookie banners that impact my actual, day to day life of the net.

That's not a failure of the companies doing the tracking, that's a failure of regulation. The EU could have legally enforced the existing Do Not Track flag but instead we get a worse web that has literally shaved off hours (days?) of my life clicking through cookie forms. And no number of uBlock scripts that promise to erase them from the web has been enough to stop them.

So, report these privacy invading companies to your local data protection body, you say! Sir, madam or epithet of your choice, have you tried reporting a breach to the Danish Data Protection Agency? They will do everything in their power to invalidate your claim. That was the last straw for me. Our protectors are indolent or powerless and here we proclaim victory!

All I've seen from these rulings is spinning wheels, wasted labor, money set fire and pain.

Our German clients have screamed and hollered (thanks, Schrems II!) to bifurcate our clouds so that one side is AWS and the other is a German cloud that moves with the glacial pace of the 90s and with that decade's service portfolio. Don't even get me started on the service level difference:

AWS: how can we literally give you everything you need to build your successful business? How about these free recruits who just graduated out of our program that specifically re-trains people from disadvantaged backgrounds to be cloud all-stars? How about regular consulting sessions with our teams to identify how you can save money with us?

German cloud: let's make setting up a managed DB the most horrifically onerous process possible that's unreliable and flaky with your data and then charge you thousands of euros for support fees fixing the things that were our fault to begin with.

This. Thank you very much for the example!

Additionally, let's break out out of the HN bubble and assume the role of somebody who is not a tech aficionado. E.g. the C-level exec of small and medium sized producing company in Germany (e.g. automotive). Now they not only face the burden of having to modernize their often dated tech system but also get the handicap of having a whole new sea of GDPR complexity before them which, if something goes wrong, can be business ending. I've seen this being a preoccupying topic for meetings for years for companies which really should not have to care (producers of automobile parts). It's a significant part of the IT budget going down the drain which could've been spend improving existing processes.

> who is not a tech aficionado. E.g. the C-level exec of small and medium sized producing company in Germany (e.g. automotive). Now they not only face the burden

Let's start with this question: how are they running their business?

> also get the handicap of having a whole new sea of GDPR complexity before them which, if something goes wrong, can be business ending.

1. There's nothing complex about GDPR

2. GDPR is not business ending, as data controllers are expected to help and guid the companies who are found to be in breach of GDPR

> I've seen this being a preoccupying topic for meetings for years for companies which really should not have to care

It means they don't care in the least. GDPR is an amalgamation of the various data protection laws that existed before GDPR. So, these "poor companies who are in meetings for years" didn't care about data protection then.

Then companies were given two years of transition to get in shape and get their act together. Omg, these "poor non-technical companies" are still "in talks for years".

GDPR has been in force since May 25 2008.

So. At least a decade of data protection laws (and German laws have always been quite strict) + 2 years of transition period + 3.5 years of the law being in effect. And it's still " preoccupying topic for meetings for years"?

> It's a significant part of the IT budget going down the drain which could've been spend improving existing processes.

Yes, indeed. If 15 years later they still can't figure out why they shouldn't keep personal data around, they definitely need to improve their processes. And IT has nothing to do with it.

s/since May 2008/since May 2018

> Do you actually work for a small to medium-sized EU business?

I did. And I do.

> Because I do and the amount of money we need to throw at compliance, both in direct costs and dev hours, is immense.

It's not immense, with emphasis. It's just the cost of doing business.

If you run into having to do compliance or certification, it means that you're doing something that requires you to be, you know, compliant.

For example, financial institutions have to be compliant. And we, as society, really-really want them to be compliant and responsible for what they are doing. Not like Equifax in the US.

> And we're not doing ads, user targeting, or any other such "nasty" industry practices.

It doesn't matter, if you do it or not. The "immense" cost of compliance is just your business deciding to cut corners and then realising that no, you shouldn't cut corners, and then scrambling to fix that when you were most likely caught red-handed.

I worked at a company which was a bit lax with its practices, and then had a run-in with an unexpected audit. Omg, you wouldn't believe, but the cost of compliance with laws was immense as we rushed to meet al requirements before the deadline imposed on us. Had we not been lax, this wouldn't even be a problem.

> I used to be think GDPR was a good thrust for user privacy but years later what I see is an adorned web already suffering under the weight of its own crap super-adorned with these cookie banners that impact my actual, day to day life of the net.

Ah yes. Another person who complains about compliance, and then immediately pretends that the state of the web is the result of a law.

No, the web is the way it is now precisely because these companies flaunt and break the law. All those cookie banner with dark patterns? They are illegal. The only real downside of GDPR is that it's not enforced as rigidly as required, and nowhere on the required scale.

As for compliance with GPDR, it's essentially zero added cost for small companies with greenfield projects. For small-to-medium companies the cost of GDPR compliance is the function of data practices. If it's "immense" for you, this only means that you were already siphoning user data you didn't need and did nothing to protect it. I can't feel sorry for you.

> Our German clients have screamed and hollered (thanks, Schrems II!) to bifurcate our clouds so that one side is AWS and the other is a German cloud that moves with the glacial pace

Once again, you blame your own technical decisions on the law. Of course German customers would want their data in Europe. Why wouldn't they? Data on American servers is basically forfeit, and can be examined, analysed, and seized by the US at any moment. Wow, I can only imagine why German customers would not want that. Whatever might be the case, hm?

> German cloud: let's make setting up

Once again: it was your decision. AWS (and GCP, and Azure) literally provides a service to European customers where they keep data in Europe only, and that is more than enough for most any compliance (I know banks in Europe who use AWS and/or GCP). [1]

So, your poor technical decisions have lead you to suffer increased costs, and you blame that on laws. Keep it up, it's a good way to stay in business.

[1] AWS: https://aws.amazon.com/compliance/eu-data-protection/, Azure: https://blogs.microsoft.com/eupolicy/2021/05/06/eu-data-boun..., GCP https://support.google.com/cloud/answer/6329727?hl=en

You don't know my company and you've ascribed practices to my company that we don't practice to create a straw man. Please don't do this.

We're working, willingly and early, with an independent auditor we hired.

As for the German cloud, no AWS Outpost or anything else we (and AWS' legal team) pitched was enough.

> The only real downside of GDPR is that it's not enforced as rigidly as required, and nowhere on the required scale.

Whose actual fault is this? The EU pushed through a ruling without teeth. It's a lose-lose for everyone from business all the way down to the person assaulted by these cookie notices.

> So, your poor technical decisions have lead you to suffer increased costs, and you blame that on laws. Keep it up, it's a good way to stay in business.

This is just rude, please don't.

> If it's "immense" for you, this only means that you were already siphoning user data you didn't need and did nothing to protect it.

Why are you continuing to state things as fact you don't have a clue of? This is completely false.

> You don't know my company and you've ascribed practices to my company that we don't practice to create a straw man.

You've asked if I worked at small-to-medium company in the EU. I told you I did. My experiences are significantly different from yours. This only tells me that there's definitely something wrong you're doing, and blaming it on the law. Since you're not giving any details, it's pure speculation at this point.

> Whose actual fault is this?

I think no one could even predict the scale of the issue. No one could imagine that:

- even well-to-do commercial companies would include literally hundreds of trackers on their web pages

- almost literally everyone would decide to break the law instead of, you know, stopping wholesale data consumption

The ad industry played a nice trick: now everyone believes the EU with its GDPR is the bad guy, and not the motherf@ers who siphon your data to 500 advertisers on every page.

As for the teeth, GDPR can fine you for a significant chunk of your global turnover. So yes, it has teeth.

> Why are you continuing to state things as fact you don't have a clue of?

Are you the only one allowed to state things?

Human rights also makes it much harder to do business in the EU. Your point?

I would argue that human rights make it easier to do business in the EU.

For example, a government which ensures that you don't go to jail for some bs reason is a government which I would be more trustful of as an enterpreneur.

This really gives me "Western regulations on labor hurts its economy compared to China" vibes.

It shouldn't. Arguments on HN are often reduced to China vs West where the tech world is much more global nowadays, e.g. Israel, India, Brazil.

As a human being who wants his information to be secure, I love it. If companies are going to peddle the personal information of individuals, and that information could potentially harm them if it became public, then getting security certifications is the very LEAST a company can do if they want to do business in that sphere. Everyone everywhere should demand it.

This is what I expected to hear. We had similar issues in the US with corporate tech when various financial regulations came down in the early ‘00s

So you're going to keep asking people until you hear what you expect to hear instead of looking at the evidence? Based on your behavior here, it seems like you have already formed your conclusion and are only looking to hear specifically what you want instead of listening to the majority.

Not at all on either account.

What are these security certifications you are referring to, and who required you to get them?

What kinds of security certifications? GDPR doesn't require any certifications

I believe you are misinformed and have formed a false dichotomy here. It's easy to primarily use small businesses, who are doing relatively fine. The only exception I can think of is grocery stores but that was the case here long before GDPR and also isn't the case in the rest of Europe. I suspect it's to do with the geography of my country.

Then explain how a smaller company markets goods and services in the EU without resorting the brand level advertising? Lack of targeting data makes it financially impossible until a company reaches a certain size.

I use newspaper ads, billboards and social media presence. Works fine. I don't need to see your nudes, know your friends, hoard your browsing history.

Newspaper ads are a fair point. Europe still has a functional local press ecosystem. That’s dead in the US.

> Lack of targeting data makes it financially impossible until a company reaches a certain size.

This seems to be a premise you are working with, but as someone with my feet in Europe, it just is not true. Lack of targeting data may make it a bit more expensive to market goods, not "financially impossible". I see ads from small companies all the time. Some are even related to my interest, specially when they are located close to things related to the ads.

The same way they always have, obviously? Also, they seem to have no problem reaching me on Facebook (the only place I can't block ads.)

I type into Google "buy computer online" and get 9 different local online shops where I can buy computers, none of them are Amazon. One of them was an ad, but the rest were just search results.

Not sure why you think this wouldn't work in Europe.

Today this is not something that affects day-to-day lives in any meaningful way I don't think.

Additionally, the EU seems to be big enough of a market for corporations to still bother with providing privacy-friendly variants of their products that mostly function in exactly the same way.

But how do smaller companies make you aware of their products if they can’t target you?

Sometimes I have a problem that could be solved with money. I google/whatever favorite search engine is for a product that solves the problem that I want to solve. At no point adtech is required, in fact I would prefer if adtech wasn't involved.

I don’t know, I have all ads blocked everywhere and still discover new products. I also discovered new things, before the internet was such an ad-ridden mess that adblockers became a requirement for decent UX.

Just like before there were targeted ads?

Well, before targeted ads there were blogs and they were well read. Not so much anymore since Google decimated that channel.

Think "before blogs". Windows 3.1 rose to dominance when the Internet wasn't a factor for the vast majority of computer users (and even less for everybody else).

How could they possibly have acquired customers back then?!?

With money… lots and lots of it spent on brand level marketing in print media as well as with direct sales reps.

Do they really need to know with which hand I am likely to wipe my arse with, though?

Smaller companies using the services provided by the bigger fish have caused a self-perpetuating circle of ever increasing imbalances in many areas.

The resources that are being spent on not only keeping this machine in tact, but as seen in the article, grow it even further, show that this machine isn't going to stop itself and that higher intervention is required.

This is going to be costly and hurt in other ways, but with it being a massive stap towards a sort of post-scarcity society as was shown in Star Trek and by the Venus project, it's worth every tear and every penny.

If anything the society depicted in Star Trek has even less privacy, but ok.

I don't want privacy just for the sake of having it. It's a tool that serves a purpose that's no longer or significantly less relevant in that story.

In general I feel the EU bureaucracy doesn't understand the problems well enough, so the solutions typically tend to be annoying and expensive without mitigating the problem (and often the problem they attempt to solve sounds like it was formulated 10-15 years ago).

> do you enjoy [...] consolidation of goods/services into larger and larger corporations?

I mean, it seems the US has completely abandoned their policy of breaking anti-competitive companies in favor of what essentially looks like surveillance mercantilism.

In that context, your question is ambiguous: are you, as often happens here, arguing that EU attempts at regulation entrench monopolies, or are you arguing that the EU should take significant actions to break US tech monopolies' presence in Europe?

In the first case, I believe there is ample evidence that anti competitive behaviour by tech companies is widespread enough that regulation doesn't significantly improve their position.

As for the second argument, the US government has always vigourously pushed back against any EU attempt at unfavourable regulation.

Neither actually. My question is more about downstream impacts on smaller companies.

For example, Apple rolls out privacy controls in iOS 14. The story is about big adtech vs Apple privacy, but the downstream impact is that smaller businesses can no longer target effectively.

GDPR and similar privacy moves in Europe have the same impact.

The result is that smaller companies either evaporate or move to marketplaces because they can no longer acquire customers at acceptable rates.

> The result is that smaller companies either evaporate or move to marketplaces because they can no longer acquire customers at acceptable rates.

I am a bit stuck here, what do you call smaller businesses? Rolling out effective targeted advertising is hard in the first place. It's even more so in an environment like Europe where potential buyers are fragmented across countries with different languages, cultures, and so on.

If anything, effective privacy laws levels the playing field. That's good for companies that can't afford a large marketing budget.

Let’s say companies with revenue between 500K and 5M Euro in annual income, but certainly smaller businesses can stand up targeted ads even if they’re just going self-serve.

Larger and larger corporations are needed to violate EU privacy rules and get away with it.

After the initial scare of the GDPR, most organisations found a way to live with them.

But obviously, it will become very tricky, and potentially costly if you want to violate people's privacy.

I guess it depends on the products and services and where they originate. Many media companies outside the EU have simply opted out of doing business there. I know the same is true of some smaller direct retailers.

That makes sense. For company that has a few potential customers in a region with complex legislation it may make sense to get avoid those customers because of cost of complying with the legislation may be higher than what the customers are worth.

A similar example is that many banks outside the US prefer not to have US citizens as customer. This is also because complying with US laws is more costly than the money made from US citizens.

When it comes to smaller retailers, that is probably due to the EU tax rules. That's a pity. But possibly hard to improve.

Yes, the VAT structure is particularly painful for retailers outside EU for many reasons.