logoalt Hacker News

eykanaltoday at 4:36 PM25 repliesview on HN

Google eng mgr here. I've worked on a few projects related to compliance with various government policies. This isn't "assign a two-pizza team to it, will be done in a quarter"; these types of compliance efforts can mean completely redoing multiple core systems to handle privacy, wipeout, audit, reporting, per-location policies, etc etc. These efforts can involve hundreds to thousands of people for multiple years.

Sure, there's a messaging component to this. However, any company that isn't trying to just skirt the law will aim to do this sort of thing correctly, and it's an enormous effort.


Replies

afavourtoday at 4:41 PM

To me that reads as an even greater reason not to delay it. If you knew the restrictions day one you’d be able to engineer the system to accommodate them. Waiting until post launch now means a massive amount of re-engineering.

I know it’s not quite as simple as that but I do think it shows Apple are more interested in blaming the EU than reducing the potential issues ahead of time.

show 2 replies
ornornortoday at 5:40 PM

Okay? I don’t see the problem, these requirements are known from the beginning so if complying wasn’t planned and requires re-architecturing the software to make it happens that’s on the engineering org not on the EU regulator. Unless I’m missing something?

show 2 replies
tmcbtoday at 6:41 PM

> these types of compliance efforts can mean completely redoing multiple core systems to handle privacy, wipeout, audit, reporting, per-location policies, etc etc.

Maybe the phrasing is unfortunate, but if compliance to the law requires a “redoing”, launching in that market was never a priority in the first place. That’s a completely legitimate choice, but usually companies whining about regulations are making a financial decision rather than an ethical one.

fnordsenseitoday at 4:51 PM

The point isn’t that it’s easy or straightforward to do. The point is that one of the world’s wealthiest companies can spare the resources needed to comply with the regulations of one of the world’s largest markets.

show 3 replies
skeledrewtoday at 5:59 PM

There wouldn't need to be a redo if the products had been built with compliance in mind. This law isn't something new; it's been around for years now. Not taking it into account from the beginning with the intention of operating in the jurisdiction means there's definitely intention to skirt. Particularly given the previous issues in the same department.

show 1 reply
piyuvtoday at 5:37 PM

It’s not an enormous effort if you plan for it. They clearly knew about this, and could’ve afforded to plan for it. Their whole shtick is locking users in, and DMA is their nemesis.

KaiserProtoday at 7:15 PM

Meta research eng here

Yes, but also its much cheaper to build it in at the very start.

When we built pervert glasses research platform, if we'd just ignored the data privacy laws we could have built it much quicker. But, the only reason it took extra time is because

1) we had no idea what we were doing and

2) the lawyers had even less idea, so we had to do a bunch of reading and make a best guess.

Turns out the guesses were right, but it was painful getting the lawyers to understand.

flohofwoetoday at 7:02 PM

> these types of compliance efforts can mean completely redoing multiple core systems to handle privacy, wipeout, audit, reporting, per-location policies, etc etc. These efforts can involve hundreds to thousands of people for multiple years.

What if I tell you that there's a surprisingly simple, straightforward and above all very cheap solution: don't implement privacy-invading or anti-competitive features in the first place ;)

show 1 reply
matheusmoreiratoday at 6:23 PM

> completely redoing multiple core systems to handle privacy, wipeout, audit, reporting, per-location policies, etc etc

So Google chose to be evil, now they have to rip all the evil out and redo it from scratch. Can't say I have any sympathy. Should have done the right thing from the start.

krzyktoday at 4:48 PM

Why does systems are not designed take into account that compliance work?

show 2 replies
aprentictoday at 6:19 PM

You're essentially saying that privacy violations are baked into the cores of these systems.

show 2 replies
Xirdustoday at 4:45 PM

So, what are the chances they'd completely redo multiple core systems in the 18 months they asked for?

Garleftoday at 6:20 PM

It's also not a "two-pizza team" market.

bambaxtoday at 6:41 PM

So? It's also more effort to work everyday to earn a living than simply stealing what you need from your neighbors at gunpoint. But the law's the law.

As a European I'm conflicted because I think this particular set of privacy laws are overreaching bordering on stupid; but "exemptions" for one of the richest corporations on earth would be beyond absurd and infinitely worse.

show 1 reply
BrenBarntoday at 7:07 PM

> these types of compliance efforts can mean completely redoing multiple core systems to handle privacy, wipeout, audit, reporting, per-location policies, etc etc. These efforts can involve hundreds to thousands of people for multiple years.

Then you should have done it right the first time.

apercutoday at 6:40 PM

Agreed, unless you specifically know how a regulator will interpret a broad requirement on a edge case it’s a lot of effort to even figure out what the plan is, much less implement it.

Krasnoltoday at 6:17 PM

I have a crazy idea: design the product with compliance in mind already!

ivan_gammeltoday at 4:42 PM

Privacy by design isn‘t enormous effort, as every European engineering manager will tell you. It‘s just another reasonable and straightforward set of requirements. Of course, if you want to have privacy-less features in jurisdictions permitting it, that‘s a different story and that‘s a choice.

show 2 replies
greatgibtoday at 5:34 PM

The truth is very often that it is long and hard not to do the work to comply but how to not comply or do complicated things to abuse of loophole despite being able to pass the law on the letter of it.

Especially in the case of apple or Google. Look at the app store situation. It is very straightforward to do the work for the whole thing to be open to any competitor. But it is hard to try to design and implement a solution to try to not break any regulations but still manage to keep users captive the maximum without having competitor entering our walled garden.

epolanskitoday at 4:37 PM

Yet Gemini had no issues to comply with EU's DMA and release on all phones?

Let's call it how it is: Android phones allow every competitor to run their chatbot in place of Gemini. Want Perplexity instead of Gemini? You can have it. Samsung launches with Perplexity as of late.

Apple? As always, went into "ay mate, too integrated, can't give the same APIs to competitors" lame excuse.

show 4 replies
bfleschtoday at 4:43 PM

Wow, Google must be a poster child for privacy then.

joe_mambatoday at 4:39 PM

>These efforts can involve hundreds to thousands of people for multiple years.

And yet Apple had no major issues complying to the draconical demands of the CCP to sell and operate there. Weird.

Also, it's not like Apple can't afford the manpower for this. They're not a hole in the wall mon & pop shop.

show 1 reply
psychoslavetoday at 7:04 PM

[dead]

McDyvertoday at 4:38 PM

It goes to show that privacy is not a priority. And it should be.

show 4 replies
miohtamatoday at 5:59 PM

Also it does not matter what you do in the end. If you are Big Tech the EU will sue regardless and always finds an excuse.

show 1 reply