alt Hacker NewsWell, you don't have to do any of that stuff if you either are upfront about selling user data and ask if it's OK, or if you just don't do that stuff at all.
Replies
master-lincoln • yesterday at 1:31 PM
But to know that you would have to study the laws of other countries or in this case EU which costs money and in this case is not an obviously beneficial investment.
➕ show 1 reply
troad • yesterday at 1:30 PM
European law imposes a great deal more obligations on a business than that. This claim is simplistic to the point of disingenuousness.
➕ show 1 reply
If your site is covered by GDPR and you do not have a physical presence in the EU you have to appoint someone in the EU to receive mail on your behalf, so people who want to make GDPR requests by mail can write to them. See Article 27.
There are services that will do this for you. Last I checked they were typically in the neighborhood of a couple hundred Euros a year.
Whether or not GDPR applies to a site not in the EU is somewhat subjective. It comes down to whether you envisaged serving people in the EU.
If your site does not need EU visitors it can make some sense to block them. That provides evidence that you did not envisage serving people in the EU, and then you don't have to figure out if you need to be hiring a service in the EU to receive GDPR mail.