This has been said about the EU, but the market has proven to just be too big to ignore.

It could also be the reverse (see authoritarian countries), with international players leaving the market and local ones filling the space.

By "ignore it" I mean "ignore the law", not ignore the UK market. At some point the idea that countries can regulate the internet outside their borders falls apart. The US succeeds in enforcing its gambling laws WRT Americans, but that only works because other nations agree to do the enforcement.

I just don't see that happening here. So maybe the UK becomes a no-travel zone for anyone in the worldwide tech industry? That would be sad, but it's a plausible outcome.

The US can enforce it for Americans because it's comparatively easy to see that somebody is making money from gambling, compared to visiting a website.

The EU's a bit bigger than the UK by a fair margin.

Probably by about 5x. If the UK makes things difficult, they can just be ignored.

It's actually 7x (65m vs 450m).

Depends on what consider a proxy for market size. EU GDP to UK GDP ratio is about 4.5

Very few websites comply with GDPR. Based on recent interpretations, it's essentially impossible for any US-owned or US-hosted site to comply with GDPR. The EU is just being extremely selective about its enforcement. If they ever decided to follow the law to the letter, most of the Internet would have to disconnect the EU. Theoretically the EU could make clones of all international sites like China has with Baidu and Weibo, but it's hard to see how that would be good for them.

The UK's law is obviously a bit different as international companies can comply with them, but it would essentially just limit legal websites to big tech who have enough market reach that all that compliance could pay for itself.

Well, the EU itself adheres to law very selectively itself. For example for surveillance. They retroactively legalized mass surveillance by European authorities to make the impression that the law is more relevant than it actually is.

Not really as GDPR has specific provisions for governments to collect data for national security/defence, prevention/investigation of crimes, etc . So they did not have to retroactively change anything as it was written into the law from the beginning.

> Theoretically the EU could make clones of all international sites like China has with Baidu and Weibo, but it's hard to see how that would be good for them.

We would have real privacy protection, and presumably in the very long term we'd see the benefits of that (more creative new ideas coming out of the EU, wealthy people preferring to live in the EU...).

Seeing how the EU political set also is trying to get rid of E2EE messengers and such, I get a feeling it will not shake out that way either. It might make it worse, because they would have full legal and extra legal thumbscrews to apply to these EU only companies.

> wealthy people preferring to live in the EU

Wealthy people care a lot more about taxes than vague notions of privacy protection.

> Wealthy people care a lot more about taxes than vague notions of privacy protection.

Wealthy people are already willing to pay a premium for the sake of privacy. Look at Zuck buying his neighbours' houses.

Actual physical separation and privacy. Not vague notions of privacy protection.

> If they ever decided to follow the law to the letter, most of the Internet would have to disconnect the EU

It's worth noting that it's the US that would be isolated here, not the EU.

A very large number of other non-EU countries have implemented/are currently implementing extremely similar legislation to the GDPR, including Brazil, Israel, South Korea, Argentina, Canada, Japan, India, New Zealand, Indonesia, etc.

If the world eventually splits into "privacy-required" vs "privacy-optional" internets, the US will be one of few major countries in the latter camp. Yes, clearly the US-based internet is a large chunk, but long-term isolating the US internet entirely from most of the rest of the world will have a meaningful impact.

The EU has an list of countries whose current protections they officially recognize as already equivalent to the GDPR here: https://ec.europa.eu/info/law/law-topic/data-protection/inte...

Regarding GDPR, citation needed - do you have actual links you can share to those claimed "recent interpretations", and whose in particular they are? I'd be quite interested to see them, if true ,which I seriously doubt - for the time being, as an EU citizen, my understanding is, and continues to be, that it's totally possible for US corpos to adhere to GDPR; it would just require some money and effort to be spent by companies that blatantly hoover and hoard personally identifying data in hopes of squeezing some monies from it. And having to spend some money on anything that is not an investment into more money in the future seems to always trigger over-the-top allergic reaction in corporations. Until they feel the teeth of real law in painful fines, when suddenly "impossible" things will magically become possible.

They're decisions by the governments of Germany, France, and Italy:

* https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/

* https://www.cnil.fr/en/use-google-analytics-and-data-transfe...

* https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/d...

So far they've just been enforced against companies that use Google Analytics, but the reasoning behind it has been that having users connect to a US server enables that server to know EU users' IP addresses (which are legally PII), which would be subject to US government subpoenas to collect such, and the US government has not agreed to handle data in compliance with the GDPR, therefore it's illegal to have users connect to any US servers. It has nothing to do with "hoover[ing] and hoard[ing]" data.

The only way for an American website to comply would be to form a separate company not subject to US control at all. However, at that point it's not really an American website, since no data or control can go to the US.

Theoretically you could use some international service to handle all primary routing and get users to waive their rights under the GDPR before connecting to your website proper, but I'm not aware of such a service at this time.

Doesn't seem so clear cut to me yet, but I see what you're hinting at. The first one seems about Google Fonts specifically, together with IPs indeed, but not mentioning US govt subpoenas at all (at least in the English translation of the abstract). Personally, I long believed Google Fonts are a risk from privacy standpoint and not really necessary, just easy - this seems to basically be reflected in the abstract and makes me quite happy. Interestingly, it seems to mention severity of the privacy abuse potential vs. benefit, which again sounds great to me. Now, the 2nd one mentions GA and subpoenas, so this becomes more tricky and I wonder what will come of it. Though for the time being, GA is exactly a target I hoped would be regulated, so again rather happy for now, though I see how this seems indeed a concern dealing with any US company. And how connecting the two (i.e. IPs as PII + US govt subpoenas) becomes a concern as well. IANAL, obviously, though. But interesting, thanks!

I don't really think being a good 'worldwide' business can exist when longterm there are conflicting views held by governments about what is right. The fact is some governments and societies values are objectively better than others

How does any of those things make it "essentially impossible for any US-owned or US-hosted site to comply with GDPR"? Is it legally required in the US, for example, to use Google Analytics?

No, but that's irrelevant. It's illegal for an American to host a home server with EU visitors for the same reason it's illegal for them to use AWS or Google Analytics. A GDPR-compliant website can't embed Google Analytics or Google Fonts or a US-hosted image because then the host could log those IP addresses and the host could be subject to a US warrant. Likewise, a GDPR-compliant site can't be operated or hosted by an American because then the operator/host could be logging visitor IP addresses and be subject to a warrant and be compelled to give the government the evidence.

> Likewise, a GDPR-compliant site can't be operated or hosted by an American because then the operator/host could be logging visitor IP addresses

Because you "could" be logging visitor IP addresses? First, why would you have to log them? Is this a legal requirement in the US? You can't serve a page over HTTP unless you log a crapton of stuff for the government? And second...I don't believe it's illegal to log IP addresses under GDPR as log as the user consents to it...or is it?

Yes, the EU says it's illegal if you could be logging them, regardless of whether you are or not.

And yeah, it's not illegal if a user consent to it, but the issue is that the user has to connect (with their IP address) to give you his consent or not. That's why I said theoretically you could use some international service to handle all primary routing and get users to waive their rights under the GDPR before connecting to your website proper, but I'm not aware of such a service at this time.

> Yes, the EU says it's illegal if you could be logging them, regardless of whether you are or not.

Wait, what? Where do they say that?

> That's why I said theoretically you could use some international service to handle all primary routing and get users to waive their rights under the GDPR before connecting to your website proper

Why would you do such a complicated thing?

US cloud act makes it impossible for any US company to both collect any personal data and be fully compliant with GDPR.

> If they ever decided to follow the law to the letter, most of the Internet would have to disconnect the EU.

Or those sites would have to comply with GDPR. Why is that not an option?

Because no US company can exempt itself from complying with US warrants. Thus, the EU always views data as being potentially shared with the US government. The GDPR prohibits even making a log of IP addresses if there's any US control over it.

I don't see how these multinational companies like Apple, etc don't end up with their own armies again like age old.

Apple HIMARS -- the missile pods have rounded corners (but aren't compatible with NATO standards).

Like Pepsi?

^^ Underrated comment of the year.

This definitely seems like a likely outcome, especially considering how the world has responded to GDPR: ignore it if you're out of the EU or throw resources at the problem to meet a bare minimum requirement (and cross your fingers) if you're in a country where it can actually be enforced.

After my ears bleeding from trying to understand the legislation, I know I'll be ignoring it.