I was thinking of starting my own blog recently. I like the idea of having comments section in blog powered by Disqus or another service that can be embedded in website with javascript. But this will be violating GDPR? Is it risky move?
From now on we should load all page resources from the same domain? No more using of external javascript to power syntax highlighting for code blocks, commenting section? What do website owners think about this penalty decision? What changes will you do to your websites to protect yourself?
FWIW, yesterday I rushed to change my sites to serve all assets locally.
When you now do what was the right thing to do to begin with - not introducing third-party tracking from unreliable countries - then all is well.
Decisions like that will only lead to more people and businesses hosting everything themselves when they probably shouldn't. With font files there's probably little that can happen in case one hosts those oneself.
However, for other aspects such as not being allowed anymore to use any third-party service with any connection to the US whatsoever, it's not quite as simple.
If everyone now starts hosting everything themselves, we'll end up with less secure systems, worse security, and less user privacy, because most people and most businesses won't be able to maintain the same security standards as companies like Google. For many services, there simply is no EU-based alternative without any affiliation to US-based companies.
Even if there is, the question remains if those are able to provide the same level of security. Unfortunately, there's this widespread fallacy that a service or provider automatically is "safe" simply by virtue of being EU-based.
Long story short, it is what it is. Not complying with this decision puts you at risk. If that risk is easily mitigated by loading files from your local server instead of a CDN, there's no reason not to do it.
As for services such as Disqus it's more complicated, though. Disqus isn't exactly known for being particularly privacy-friendly. So, apart from the hosting question, it might be a good idea to look for alternatives anyway.
Blogging software products such as WordPress often provide a comment feature out-of-the-box. So, why use a third-party service for that in the first place?
This could actually prove to be a boon for EU devs. A huge market of “X-but-GDPR-compliant” just opened up. Plausible is already out there doing analytics, I know Sweden has a service for GDPR-compliant commenting for newspapers.
That market does not exist, it will never make money (maybe from leeching the public sector but everyone makes some scraps there). In fact the idea that laws will create a market was a bad idea.
Currently, the only GDPR-compliant solution in that case is to self-host a tool like Jitsi, which comes with the security headaches outlined above, though.
Now imagine this: Then one day you change the image with something else (example - birds picture). Can I sue you that without my permission you changed MY website?
My logic is that if in court I am responsible for something that is outside my webserver (it is on your webserver), then you should be responsible too? (it is still your webserver)
What if one day you decide to start logging IP addresses, and move your blog from your garage server to AWS in USA without notifying me?
You own a website, then you're responsible for the content on said website. You choose to embed content from 3rd parties? Then you take on a risk. If you have a business relationship with this 3rd party, then you can maybe take them to court.
Look, there’s two options:
1) Only serve things your control.
2) If pulling in stuff from a third party (ie instructing the users browser to pull in stuff from a third party), have an agreement with the third party.
I think it's becoming increasingly risky to include many different domains without naming them in your terms and explaining what they do with your users data (in this case the IP-Addresses).
It'd be hard for services like Disqus. In such cases I think you'd need to include them in your terms/privacy policy.
Disclaimer: I'm no lawyer/expert
