> geo blocking for UK IPs (like 99% of websites will)
Nahh, they'll just ignore UK law just like they ignore other countries laws. I mean, do you really expect every website owner to be versed in every single country's laws? There's no way!
Unless they "do business" in a specific country (e.g. selling goods/services) there's not really any downside to just ignoring that country's laws (when it comes to website/data stuff).
I don't plan to ever sell stuff to say, Guyana and never plan to go there. Why should I care what their laws are regarding websites/data collection? It's completely irrelevant.
> It seems strange to me to have this enforcement of policies from countries that are not my own just because my website is accessible from those countries.
If you open shop in a different country, you follow their laws. Your website being accessible in a country is seen as the same thing. It's not hard to implement geo blocking if you want to show best effort and thereby opt out of it.
> That does create a dilemma for a country that wants to prevent its citizens from accessing content hosted by a company without a presence there. Their only real option is a great firewall of X.
Which is fine. If I have no business relationship with anyone in country X, if I am not present in country X, I do not intend to ever travel to country X, and I am not hosting my stuff in country X, I don't give two figs about their laws.
They are free to block me if they want, with whatever mechanism (fine-tuned, or crude) they want - but I'm not responsible for my http server responding to GET and POST requests from their country (Unless my country has embargoed them), just like an author is not responsible for a citizen of X reading their books (That are banned in X.)
> But consider the implications. Firms hosting content from a particular country would be subject to court orders from every country. That would not end well.
They already are if they target users in a given country. Lack of international enforcement just means that they might escape enforcement. See also GDPR, the US case against Mega, a company run by a NZ resident and incorporated in Hongkong IIRC. See also how Twitter blocks certain tweets in certain countries lest they’re blocked completely. Same holds true for Facebook. Google censors certain autocomplete and searches in some countries. They also adhere to the EU “right to be forgotten” regulations - despite being an US company.
>That isn't an example of what we are talking about and you should know that. If they can't enforce things as they do now, they'd need to block domains/firewall a la China.
It is exactly what is being talked about. Countries impose their laws on companies operating in their jurisdictions. Sometimes even on organizations that are outside of their jurisdiction as well. E.g. the pirate bay. https://en.wikipedia.org/wiki/Countries_blocking_access_to_T...
The internet is already a mix of legal jurisdictions and you can face legal consequences for your word press blog in some random country.
>You really are missing the point. You are talking about one off transactions of a substantial dollar value and not short-term online accounts with values measured in pennies.
Cold medicine costs seven or eight bucks, but you still have to present ID to buy it. Regardless, your complaint reinforces the fact that there are business models that are only profitable because they can externalize the damages they cause or divert profits away from those who deserve the profits of a particular work to themselves as a service provider.
> That would mean blocking UK users on their properties, not helping them find ways to break the law.
That's a sad reflection of the tech industry. Too much "we can't make money from them" and too little spitefulness of the sovereignty of foreign governments.
> This is why many websites just block European IP addresses entirely.
This is not sufficient. IP addresses do not have sovereign rights and only loosely correlate with the legal jurisdiction of the user behind the originating packet.
This is a world where, by connecting to the internet and exchanging packets, you are simultaneously liable for every law under every jurisdiction; it’s just a game of roulette which jurisdiction the packet you receive is coming from.
This doesn’t seem scalable, sustainable, or particularly good for human/civil rights.
> If so, does it mean that, as a hypothetical website owner, I need to understand and be compliant with every law in every possible country, or risk fines / imprisonment?
This has literally always been the case. Some nations have legal statutes that they will not enforce a foreign judgement against their own citizens (such as the US shield against UK libel judgements) but you're on your own if you leave your country of residence. Plenty of US newspapers still block access to the UK of stories they feel legal risk from for example, because their owners would like to go on holidays sometimes.
Extra territorial enforcement is a lot more muddy than people think, but it's never, ever been the case that you're fine if you're incorporated in a different territory. If they can demonstrate that there's a body of people in their country accessing the site, then generally you are liable. It's just if the legal system considers that to be too much of a pain to worry about.
> why the UK would allow their constituents most personal data to be transferred out of their jurisdiction
Are there limitations with using products/doing business outside the UK, from within the UK? As in, is there any authority that they could use to stop people from, willingly(?), using a foreign internet service? It seems that would require some pretty draconian internet policies.
"Why must WhatsApp comply with Brazilian laws? They have no offices there.
"
They don't.
They only have to comply if they don't want to be blocked.
"If I run, say, a porn site, hosted in the US, as a US company, is it my responsibility to prevent users in a country where pornography is illegal from using my site? Do I have any duty to comply with said country requesting the identity and viewing history of citizens living in it?
"
Generally not, as long as you are not going to travel to that country and subject yourself to personal jurisdiction ;-)
"Of course not. That country can certainly block my site if their laws allow them to, but the idea that whatsapp /has/ to comply is ridiculous.
"
Errr, they have to comply or be blocked from brazil's perspective, and that's what the poster said.
It doesn't sound like you disagree with that, so i'm not clear on what you are arguing for ...
Apparently they have, because IP laws do, as you said, apply to the internet.
> The example makes no sense because it has nothing to do with IP. It is also dependent on jurisdiction.
The example was absurd by design. IP laws differ strongly per country. Which of those should the internet adhere to? All of them? This would not work, since some works which are protected by IP law in one country would not be by another country. Should it be decided by the country of the uploader? Or that of the downloader? Of maybe the country of the server where it's stored, or each countries' IP laws in which there are nodes it passes through as the data gets to its destination?
There is no sensible and doable way to apply IP laws, or any countries' laws in general, to the entire internet. The entire idea is, to me, a non-starter from the get-go.
> The absolutely first thing I do at every company and on every project is ask if I can block russia, china and belarussian IP space
Sorry for the language, but fuck that attitude. I don't live in any of these countries, but I used to live in a large European one that still regularly gets blocked by US sites for no fathomable reason.
Maybe you should try using the internet from a VPN location outside the US to see how fun that is as a paying customer of the sites that are blocking you for your crime by association (if temporary physical presence can even be called that).
One time I couldn't even unsubscribe from a VOD streaming service that I had been subscribed to while on an assignment in the US once I was back in Europe because their entire website was just a big geoblocked mess, including account/subscription management. Of course they were still happy to take my money! Less egregious but still infuriating: OMNY, New York's open-loop transit payment system, just outright blocks me when trying to access my account from Europe. Have the people ever considered the scenario that a visitor might use their service and later need the receipts for e.g. an expense report? Sure enough, London's TfL does the same thing for the US.
I can't wait for the day that the decision makers responsible for this insanity get stuck on a business or holiday trip like that and realize how annoying this is – or even better, realize that things like VPNs and botnets exist and can obscure the source of any Internet traffic...
> I would start some sort of embargo, countries that enforce these kind of rules, simply ban all traffic from the country.
I wonder how it would work the opposite way: Start redirecting google.co.uk to uk.google.com, hosted and operated by a non-UK corporate entity outside of UK jurisdiction. Make them block you. China would do it; would Britain?
>Blocking access to pages from countries where the court order was issued seems entirely reasonable to me. //
Shouldn't you just let that country block for itself what it doesn't want?
If you have products available in your country that are unlawful in another then you wouldn't stop individuals from that country from buying them in your country, you'd let the other country police the import, surely? Seems analogous to me.
> If you accept one connection from a user in some country, you are doing business in that country.
I disagree with this. I have an open port at 80 and 443 and whoever wants to connect to it can do so. If my server is physically in the US, it only needs to obey US laws. If someone is violating their country's (weird) laws by visiting the server, that's that person's problem.
It's not my job as a developer, website host, or business owner, to for example ink out photos of women because Saudi law requires that. It's not my job to remove references to the Tiananmen incident. Those countries can, if they would like to, censor my website at their borders with a firewall, I don't care. It's not even my job to track down where your IP address is physically located. I couldn't care less about your IP. You could be using a VPN, for all I know.
Iran or China has issues with my website? They'll block it. Problem solved. I don't have to think about it too much. They do the work for me.
EU has beef with my website? Go ahead, you block it too, I don't care. I'll grab some popcorn and sit back and watch how your citizens react. (hee hee)
> And much more uncontroversially, if you are accepting payments from someone in another country, then you are definitely doing business in that country.
I disagree with this, as well, if those payments are coming from individuals and not businesses. If an individual in Germany flies over to the US and buys something from me, they are subject to US laws in that transaction. They are subject to German laws when they take that thing back. But in NO part of the entire process am I subject to German laws.
That doesn't change if "flies with an international flight" changes to "travels virtually via an international TCP connection".
Nahh, they'll just ignore UK law just like they ignore other countries laws. I mean, do you really expect every website owner to be versed in every single country's laws? There's no way!
Unless they "do business" in a specific country (e.g. selling goods/services) there's not really any downside to just ignoring that country's laws (when it comes to website/data stuff).
I don't plan to ever sell stuff to say, Guyana and never plan to go there. Why should I care what their laws are regarding websites/data collection? It's completely irrelevant.
reply