Correction: they claim that it is. The 451 code is specifically made for that, referencing Fahrenheit 451, so using this specific code implies censorship.

However, it would be totally legal for them to provide the content. They just don't want to take responsibility for their privacy invading practices. So it's not censorship at all.

/me shrugs. Personally, I have yet to find the website I can't just close if it behaves like this.

Thanks I meed to bookmark that site. It is sad the hops you need to go through to browse the web.

Websites have been given a practical choice between annoying popups and blocking Europe.

It makes my life better when they block Europe, and I wish more did. I also wish Europe got rid of the GDPR.

There is also the the third option of course: not tracking users.

A lot of non-technical organizations deem it safer (and cheaper) to just block EU users than to study the law, become domain experts, and implement lawyer-approved mechanisms to become compliant.

The reality is, however, unless you have a major presence in the EU, or are the size of Google or Facebook... you can freely ignore the GDPR without consequence. EU laws do not apply across the ocean.

Once again, that ignores the third option, simply not embedding javascript tracking bloat in your site, or at least serving that version to the EU (since they've clearly already spent the technical resources of identifying it and serving a different response).

You don't need to be a legal expert to just not collect data you don't need.

If there's not a tech expert in the room when a content publisher meets with their legal counsel, that is not a possibility anyone even realizes exists.

It is also more expensive to implement than

    if(blocklist.contains(ip)) res.sendStatus(451)

It's not that simple for non-technical organizations, I'm afraid. Simply embedding Google Analytics (the de facto website traffic analyzer, for better or worse) is enough to violate GDPR, and embedding Google Analytics is very often a simple checkbox in the web host admin portal.

The "technical resources" involved in identifying EU traffic is nearly always just a simple IP block list, where one can often just checkmark a list of countries in their web host's portal.

I think you grossly overestimate the technical prowess required to operate a website these days, and I think many grossly overestimate the actual real-world impact of GDPR outside the EU borders.

Google Analytics is exactly the kind of tracker bloat I'm pointing out that a website serving static articles doesn't need. It can strip that out and serve a static html page, with no bloat, through Cloudflare, and even get their tracking through Cloudflare as well.

The reason why such "technical prowess" is needed is because businesses have made it more complicated than it needs to be. Keep in mind, the context of this conversation is the arrogance of literally claiming claiming you are being "censored" (because that's what the 451 response code indicates), just because you refuse to remove tracking analytics from your website.

I think this is a forest and trees situation. Using things like Cloudflare, alternative niche "privacy conscience" trackers, adding GDPR popups, etc. are all way above an beyond your average website operator's abilities or understanding.

The dude trying to sell custom T-Shirts has a website because it's a necessity to sell T-Shirts, not because he enjoys operating, optimizing and customizing websites. He just wants to sell more T-Shirts, and some European Union law isn't going to give him pause even for a second if he is physically not in a EU country.

While good intentioned, the GDPR was specifically designed to be a "viral" law and force the entire internet to comply... unfortunately the EU's long arm of the law is fairly short. Further, the EU's ability to enforce the GDPR is limited to businesses physically under it's jurisdiction - ie. the US is not going to extradite some website operator for an alleged GDPR violation, no matter how severe the case may be, and the EU can only fine a business into compliance if the business cares about EU laws (which would imply a physical presence in the EU).

Ignoring the GDPR is the right move for most websites.

If people desire comprehensive, impactful privacy guarantees, then a similar law needs to be passed within the US.

Wouldn't you rather websites just stop invading your privacy? The EU is not to blame for the shitty business practices of these websites.

GDPR has compliance costs even if you are doing nothing that violates privacy. As long as you've got data that can be associated with a user you might have GDPR obligations, including handling inquiries from users about what data you have about them, requests from users to delete their data, and similar.

Just being able to receive such requests has costs, because GDPR requires that you have a contact in the Union that users can contact for such things.

So say you've got an online forum in California and some EU people join and participate. Whether or not that is enough to make you subject to GDPR depends on Article 3(2). There's lots of subjectiveness in Article 3(2) so it is not at all clear where the boundaries are.

If it does, then whether or not you have to have an in-Union representative is covered under Article 27. You do not need one if your processing of covered data is all of the following: (1) occasional, (2) does not fall under some special categories of data, (3) is unlikely to result in a "risk to the rights and freedoms of natural persons".

That's pretty fuzzy. What is occasional processing?

If you aren't sure that GDPR does not apply, or aren't sure that if it does your processing is occasional enough to fly under Article 27's radar, you need an Article 27 representative.

Eventually there will be rulings from EU data regulators that will make the boundaries of Article 3(2) clearer, so that you may be able to stay in "does not apply" without blocking. Or maybe rulings will clarify Article 27 so you will be able to confidently determine that your processing is occasional enough to not need a rep.

There's actually a lot of unclarity in GDPR. Take the data subject's right to have you delete their data. How do you actually implement that? Writing some scripts to delete from your database is probably not too hard.

But what about backups? Do you need to go through all your backup sets and delete their data from those? What about printed records (yes, GDPR covers printed data)? Offsite long term archives?

For a site like a forum, what about data that was in messages they posted that were quoted in messages from other users?

Until all these kind of things are cleared up by EU data regulator rulings it can make a lot of sense for a site that is aimed mainly at a non-EU audience to block EU users.

The effective result of GDPR has been less than ideal, but was a step in the right direction. Abolishing it entirely in favor of a vacuum would carry a more weighty cost.

The frustrating part is that the unintended consequences of GDPR were inevitable and clearly foreseeable, yet it was passed into law anyway and now it's incredibly difficult (if not practically impossible) to fix through iterative adjustment. It often seems like politicians and bureaucrats are incapable of seeing the myriad ways their well-intended rules will fail in the real-world. Maybe all legislation should first have to pass an "Unintended Consequences Analysis" review.

Meanwhile, GDPR is yet another disruptive annoyance to users, a burden on overworked, under-funded website teams and isn't delivering the benefits promised.

It doesn't have to be disruptive to users, companies go out of their way to make it disruptive. As others here have said, companies can just stop adding code to track users and stop storing so much information. It's actually way less work.

But why blame the companies who are directly responsible for this annoyance when we can blame the government who is indirectly responsible?

The GDPR covers tracking of users, but is much more broad in scope. Simply not tracking users doesn't stop the GDPR from applying.

The GDPR provides a framework by which bad actors can do their thing legally without too much trouble. To a good actor, who only stores the data they actually need and doesn't track users, the GDPR still applies and is just as big a pain in the ass.

Legitimate interest is excluded from the GDPR, so what kind of "good actors" are you describing that are hobbled by the GDPR? Be specific, please.

Anyone who doesn't want to deal with the hassle of hiring someone in the Union as their Article 27 representative.

> a burden on overworked, under-funded website teams

It's only a burden on these people if they choose to be user-hostile.

There are really easy ways to deal with GDPR but these dumb companies insist on avoiding those solutions at all cost.

If companies insist on being dicks, then the only possible government-level solution might be to just ban this kind of tracking outright.

>Meanwhile, GDPR is yet another disruptive annoyance to users, a burden on overworked, under-funded website teams and isn't delivering the benefits promised.

Users can now demand we delete their account and data and we have to do it, this is some work for us but it is good for users.

Also do you forget that popups were a thing before GDPR? Modal for you to subscribe to some shit,monthly Terms of Service changes, notifications to see what new feature was added, to see what new stuff some contact posted were a thing, with GDPR you get a one time popup , you make your choice and you should be done.

In summary

Pros for users:

- transparency, you now know about the 100+ partners and you can decide

- you can ask for your data and ask for it to be deleted

- you will get notified if your private data is lost(mioght be adifferent law for security breaches)

Cons:

- Shit websites use dark patterns and annoy you with a popup one time

No Pros for developers, companies: Cons for devs and companies:

- you need to research the law and find ways to screw the user with dark patterns

- you need to update some old project and remove tracking or implement some popup , implement account deletion, data demands etc

- you need to update your ToS documents, privacy policies

- almost never happens, you remove tracking or configure your ad script to don't track and you don't store private data.

From what I see users EU ones) have a lot to win, I assume if you are not in EU seeing the popup is a bug and would be fix .

Or they could just not track people...

pretty sad that this is unthinkable.