Process all of it in Europe.

Missing the /s

As a start you'd need to read the details of GDPR laws. And probably hire a lawyer.

So now to create any web page compliant with the EU, I need to hire a lawyer to help me understand the 11 chapter 99 section GDPR?

Do you collect and store personal information for this website?

I bet you could find a dozen or more websites summarizing your legal obligations if you wanted to create one web page.

Since the context was Facebook, I was speaking about what businesses should do. And especially large businesses. As far as I've heard, the EU isn't chasing folks who run a small website.

>As far as I've heard, the EU isn't chasing folks who run a small website.

But they could, which has already had a chilling effect on small businesses. Even though the intent (and current enforcement) is to punish large companies, GDPR is written in a way that puts a large compliance burden on many small companies and startups.

I have zero problem saying your startup or small business doesn't deserve to collect my personal info if you can't protect it.

Doing your accounting, paying taxes, and following labor laws are also burdens on small businesses. Not every small business is profitable enough to manage those things and that's ok.

In order to collect, store and process data about people in the EU, you have to do so in a manner compliant with the EU law on that.

Collecting that data on a web page is a choice.

A semi-hidden security benefit of GDPR is that it makes people think twice before collecting and keeping data - you can't leak data that isn't in your database in the first place.

If I am talking to a group of friends some in the US over Facebook messenger. Should that be stored on EU servers?

Sure. Or any country that complies with EU data protection and privacy laws.

You first asked "if I create any web page".

Now "Talking over Facebook messenger" is a complete change of subject.

It is on Facebook, not you, to operate Facebook messenger in a legal way.

How can Facebook both allow a user in the EU to send messages to a group of people in the US and not store data in the US?

If you think it's technically impossible the burden of proof is on you.

Facebook has not claimed it's not technically possible.

Does it really take that much of a leap of logic that if EU person sends data to a person in the US, that data is going to be stored on a server in the US?

>Does it really take that much of a leap of logic that if EU person sends data to a person in the US, that data is going to be stored on a server in the US?

Yeah, it does. A person in the US is not a server in the US. It's an iPhone in the US, not a server.

Does it really take that much of a leap of logic to understand that the server doesn't have to be on the same continent as the user?

That's not at all how it works. You're arguing against points where your understanding of the related technology is poor.

> How can Facebook Run their business in a legal way?

There's a word for businesses that are systemically unable to comply with the law.

I don't know if Facebook is one of those, but it might be. Shutting down is always an option for that kind of company. Nothing of vale would be lost.

A US server could store the id of the European friend, and then let the app collect the data. It's not unheard of.

And if they go to the website?

Then their browser can get that data from another server. It may be more complex, no, it is more complex than storing everything in one large database, but it can be done.

And that also gets rid of caching closer to the user and now you have multiple servers and no source of truth.

You really don’t see the added complexity of this and how this makes a worse user experience?

Worse user experience depends on your priorities. Some people and companies think privacy is an essential UX factor. Apple, the most successful company in the world from time to time, agrees.

What do you think the Venn Diagram overlap of people who “care about their privacy” and use Facebook is?

Do you think the overwhelming amount of people say that they really glad that cookie banners infest the internet is a good thing?

If you haven’t heard, Apple is not exactly great at social media or anything that your data needs to be synced between devices.

Facebook operates in the EU and the majority of EU citizens prefer their privacy. Facebook must obey the laws of the land if they want to operate there.

Just as Facebook must obey Apple's rules if they want to be in the app store.

Similar privacy laws applied to some EU phone companies long before Facebook existed.

These laws are good and should stay. If better privacy has side effects, that's fine. Do business elsewhere if you don't like the legal preferences of the locals.

If the majority of people preferred their privacy, would they really be using Facebook?

And you never answered the question, how do you have a social graph with people in the US or send messages to people in the US without storing data in the US?

Yes, they would.

Not my problem how you implement it. That's Facebook's problem. My rate is $600 an hour and I'll guarantee I can come up with a GDPR compliant solution within a year or you don't have to pay. That's far less expensive than the fines, isn't it?

There isn’t a technical method to both have a message sent to a group of users in the US and not have the message be on the server in the US.

Just maybe the EU regulators are technologically illiterate?

And I see that you also punted because you know it’s impossible

> Just maybe the EU regulators are technologically illiterate?

Of course they are because

1) all regulators are technologically illiterate, these are not exceptions

2) regulations of this kind are fundamentally about people not microchips. They talk about results to people, not coding constructs or network topologies. If it's technically possible to do it, but not technically possible to do it legally, then maybe it's a bad thing and don't do it at all? If there's a new technology, is it exempt from current standards? Would you say, "hey, new weapon invented, it's legal to murder people with it!" ?

NB: I'm fairly certain that Instant messaging can be done legally; what maybe can't and shouldn't be done legally, is the FB business model of monetising user data over that. IDK why someone would defend it so strongly.

So do you also agree that e2e encryption with a backdoor is impossible to do securely? Should people not be allowed to use e2e encryption? The EU also is trying to pass a law forcing companies to have a backdoor to their encryption.

> The EU also is trying to pass a law forcing companies to have a backdoor to their encryption.

And some US state is banning one app rather than trying to find sensible privacy protection that applies to any app.

I'm not sure of your point, TBH. It doesn't follow at all from the above.

* * *

"Look over here! This law is bad therefor all laws are bad" is not a very convincing argument.

It was claimed that any law that was passed whether or not it was technically possible was de facto good.

That's a gross exaggeration of what was claimed. The idea was that if a law is good but it prevents some companies from legally operating, that's ok. For example, if a company can't profit without using child labor then it's ok for that company to go out of business. Lots of folks feel the same about privacy. If you can't protect my data, then it's fine if you go out of business.

* * *

> You really don’t see the added complexity of this and how this makes a worse user experience?

Bluntly said: IDGAF, and neither should you. Who cares if it's harder for facebook/meta to program? Must we waive our rights because of incompetent or cheap engineering?

It’s not harder for Facebook. It makes a worse user experience - just like the GDPR.

You didn’t waive your rights. You as an adult have the right to not use Facebook instead of waiting for the nanny state to “protect you”

The GDPR does make UX worse. If you have to click away a cookie banner, it's because companies love to try to coax you into accepting as many cookies as they can get their grubby hands on. Storing a cookie for session administration is acceptable. You don't even have to announce it. It wouldn't make much sense, because it's less useful than your IP address (for the purposes of tracking). Only if the site wants to do more, it must get the user's permission.

> nanny state

Sadly, technology is nearly incomprehensible to most people, and the state must protect their rights. The rest is either an authoritarian or libertarian fantasy under the pretense of liberty.

* * *

No one gave up their agency. The laws are a reflection of choices people freely made of their own will about how they want their data protected.

People didn’t make the choice. The government did.

People elected the government. The people made the choice. GDPR and other privacy protections are also widely supported by most people in Europe. It's so popular with the average person that vver 17 countries have already adopted laws based on GDPR. And it's common sense: most people like privacy and don't like someone invading their privacy.

So you're a libertarian, I guess. Abolishing protection doesn't bring freedom, it brings anarchy and in its wake, the right of the strongest. Look at the 19th century. Do you want to live in Dickensian horror? Because that's the alternative. There's no bucolic paradise awaiting after abolishing labor and health regulations. There's only exploitation of the weak.

We give up a bit of control to avoid losing more. That's a social contract that has worked very well, and I'd like to keep it that way. I'm sure you also benefit from it.

Yes, I’m sure there was anarchy on the internet before we had to deal with cookie banners.

You lose no control by not using FB.

Facebook loses no control by not operating in countries where they can't obey the laws. You keep focusing on individual choice but conveniently never include Facebook as a party perfectly capable of making choices too.

The owner of Facebook and as an adult have the right to not do business in countries where you can't reasonably obey the laws.