> The data protection authority justified this with the fact that US authorities could access personal data (probably primarily the IP address) for criminal purposes on the basis of the CLOUD Act, among other things. This occurs regardless of whether data is stored on servers in the USA or Europe.

I have to imagine the particular bureaucrats the author was dealing with are somehow wrong here? Otherwise this implies that a European business cannot use basically any American software (directly or even indirectly, like this case), even if that software fully conforms with processing and storing all data in Europe. The fact that American authorities could coerce any American company into turning data over, even if it’s stored in Europe, is enough?

This doesn't matter, EU sites have been getting fined for some time now for using CDNs like this, most popularly Google Fonts.

I guess if you fear Quantum inserts it might have some privacy/security gains.

Both in your national election which then decided the government which chose your country EU representative for the council and commission, which then created the law and decided to put it to a vote and where your government had a direct veto right, and in the European election where you elected the parliament that voted on the GDPR.

I recommend you inform yourself on the institution that govern you and how you can influence them, you seem to be deeply uneducated about them.

No candidate had on her proposal list "hunt and close cookie consent dialogs on the web forever".

I recommend you go out on the street and find out how real governing in the EU works, you seem to be deeply idealistic about it. It’s important, it could be why the next brexit happens.

Before the Schrems II judgement[0] by the European Court of Justice, companies in the US could use the EU-US Privacy Shield[1] to ensure adequate protection of EU personal data. The Privacy Shield agreement replaced and improved upon it's predecessor, the Safe Harbor agreement, which was invalidated by the Schrems 1 case.

Transfers between the EU and US can still be legal, as long as standard contractual clauses (SCC), although this requires more effort after the Schrems II case than before. Companies are now required to verify the privacy protection in the recipient country in order to use the SCCs.

The first source provided gives insight into what is required by US companies to comply with GDPR when tranferring personal data to third countries. As an anecdote, a guest lecturer for a masters course I took this semester mentioned in passing that transfers to the US are almost as bad as transferring personal data into China.

[0]: https://www.gdprsummary.com/schrems-ii/

[1]: https://www.gdprsummary.com/gdpr-definitions/privacy-shield/

From what I can tell, Shopify itself uses Cloudflare, so your domain that is connected to Shopify is passing all the traffic through Cloudflare, e.g. one of the other examples in the screenshot: https://www.distortedpeople.com/

The site is on CF (and it sets like 10 cookies, including tracking cookies, pre consent, so any dreams of compliance are gone either way), and, as far as I can tell, that's the case with all Shopify shops (but I've only ever looked into that from an outsider's perspective, maybe that's optional).

In addition, the physical location of the servers do not change anything when the company operating those servers is American. They still need to comply with the CLOUD Act, even to the point of pulling data and encryption keys from servers based in the EU.

The differences in laws and requirements by country is one of the biggest factors to consider when providing international services of any sort.

without data, it’s hard to make this argument. what we know for sure is that bureaucrats fully support the privacy angle. but from my anecdotal real life experience almost no one cares (another argument that without data cannot be generalised).

There is a huge EU project which in theory is trying to build those competitors - Gaia-X - but as is typical with such projects the results have been poor. Looks to me like a lot of the money was wasted on "blockchain" scam projects.

The thing is - there is real significant potential in the EU for some of the existing large colocation/VPS provides to become just that only the EU's own implementation has failed.

But of course, Shopify can just push this responsibility onto their customers, meaning the shop owners. That's what they currently do.

The issue is with European regulations. The lawsuit was in Germany because that’s how legal systems work around here, but the sticking points are very likely to be present in national laws across the EU. So, ultimately it won’t be about the German market, but about the EU.

I don't know how that affects lawsuits though. I'm guessing if you have any customers in Germany, then someone could take you to court in Germany, but I'm not sure...

As I see it, Shopify's role in this situation is more likely to be considered a data fence: because of the lack of processing agreement, they're not allowed to process any data (more accurately, the shop owner is not allowed to give them access to any data). The data that they do have through services they provide is illegally obtained; that doesn't mean they suddenly own that data.