If this UK bill passes, I'd simply return HTTP 451 with a note that although the UK is blocked from my site, VPNs are not.

Promoting VPN usage could be construed by the UK courts as an attempt to commit subterfuge or dodge jurisdiction. They will not take kindly to this. You really want to make it perfectly clear that you want nothing to do with Britain as long as they have crazy laws on the books.

Related point: if you're intending to get out of GDPR, blocking the EU doesn't really help, because the law applies on the basis of citizenship, not territory. If an EU citizen accesses your website in America, that's still within GDPR scope. If you have EU business assets, ship things to the EU, or have any other ties to the EU, then they still have jurisdiction and you certainly still have to comply with GDPR.

However, the GDPR doesn't really apply if you don't intend to target Europeans(2)

And the GDPR is a way way more sensible law than whatever the UK is trying to do here, nobody will comply and no body will care, its only going to Hurt UK citizens and The UK's economy.

I care about privacy and really like what the EU has passed with the GDPR and DSA, but unfortunately we will have countries that does stupid things like this. Hopefully they aren't that important so no one complies.

2. https://gdpr.eu/companies-outside-of-europe/

> If an EU citizen accesses your website in America, that's still within GDPR scope.

No, that's not correct. You have to be clearly intending to (not just incidentally happening to) offer goods or services to an EU data subject.

> ship things to the EU

This wouldn't be enough to make the GDPR applicable. You'd have to be specifically targeting EU customers in some way, such as allowing users to pay in euros - not just incidentally selling some stuff to folks who live in the EU. Your other examples (such as having EU business assets) hold because they would make you an EU entity.

Targeting EU data subjects with goods and services is just one of two ways GDPR asserts extraterritorial jurisdiction.

The other is when you are processing personal data of EU data subjects that is related to "the monitoring of their behaviour as far as their behaviour takes place within the Union".

There's a recital that adds:

> In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes.

Unlike the recital that explains the goods and services case, which talks about it only applying if you envisage offering goods and services in the Union as opposed to your site merely being accessible from the Union, the monitoring case doesn't seem to have any requirement that you are intending to monitor EU data subjects.

That's pretty broad as written. From what the recital says it even applies if you are gathering data the could be used for profiling even if you are not actually currently profiling.

As noted in the article at gdpr.eu that a parallel commenter cited:

> If your organization uses web tools that allow you to track cookies or the IP addresses of people who visit your website from EU countries, then you fall under the scope of the GDPR. Practically speaking, it’s unclear how strictly this provision will be interpreted or how brazenly it will be enforced. Suppose you run a golf course in Manitoba focused exclusively on your local area, but sometimes people in France stumble across your site. Would you find yourself in the crosshairs of European regulators? It’s not likely. But technically you could be held accountable for tracking these data.

> That's pretty broad as written. From what the recital says it even applies if you are gathering data the could be used for profiling even if you are not actually currently profiling.

I'm not aware of legal cases that have specifically hinged on this issue, but Soriano v Forensic News LLC (from 2021) touched on this clause, and seemed to doubt that merely collecting information (e.g., using cookies) without further processing it with the intent to profile would make you subject to the GDPR.

I didn't specifically mention Article 3(2)(b) - the clause you're citing - because the post I was responding to didn't really mention profiling in any way. Still, it's good to note that the legal landscape on this particular point isn't totally clear as far as I'm aware.

>Related point: if you're intending to get out of GDPR, blocking the EU doesn't really help, because the law applies on the basis of citizenship, not territory.

Argh, why won't this misinformation die? You are completely, utterly, 100% wrong.

The GDPR applies if either the data controller is established in the EU or the data subject is physically in the EU.

Article 3 (territorial scope) is incredibly short, read it: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:...

Yes and this may be a UK citizen on a trip to Paris

> because the law applies on the basis of citizenship,

No it doesn't. depends on location only. A US, or any other, citizen is protected by GDPR when they access the web from within the EU

As an American visiting the UK and the EU, I got to see what the GDPR has done to the online experience over there for the first time.

Wow, does that suck. I see about 20% of the "cookie track consent" popups Stateside that I saw browsing from the EU.

Well that's the websites problem, no body told them to include 50 trackers. And there are many filters to kill cookies banners. Also AFAIK now there is an enforced Reject All button.

It's also the user's problem because there aren't websites to go to that aren't showing those banners.

Well, except the big, commonly-used ones where you've already consented (or not). Facebook, for instance. It's like this law was hand-tuned to consolidate users into only visiting a few commonly-accessed sites to save themselves the UX annoyance at the cost of the broader Internet's discoverability.

I don't agree, many websites don't have it. Its a choice that these we sites that they want to still track everyone, and they are paying for it in bad UX.

It's the safest choice given the incentives.

So you prefer being tracked without you knowing rather than being asked and easily opt out?

Personally, yes. I think most of what the GDPR intended to accomplish could have been accomplished more easily by public education campaigns and broad cultural adoption of no-track plugins. That would have done a lot less damage to the user experience than naively assuming that if one pushed the educational burden onto sites, the sites would cease to do the tracking that triggered the educational burden rather than just bother their users forever with government-mandated information placards.

Especially given that what constituted "tracking" was so broad that a lot of sites took the "better safe than sorry" approach because it was cheaper than a full audit of their tracking and a lawyer to interpret whether, say, Apache logs that show IP address constitute "tracking."