There are a thousand and one legal reasons one may wish to block a region, including Europe. From anti-gay speech laws in Hungary, through the VAT/tax obligations that kick in at one cent, to all sorts of watershed rules and disclaimers and alien and unjust laws (such as lese majeste laws, or absurd British 'online safety' laws).

Every day I see Europeans on here sharing tips how to de-cloud and de-America, bemoaning the open Internet, yearning for Balkanisation. Cool. Well, this site does it for you. You're welcome! Enjoy!

While it may not look flattering, it is absolutely a correct usage of the 451 status code. From the standard itself[1]:

    This status code can be used to provide transparency in circumstances
    where issues of law or public policy affect server operations.  This
    transparency may be beneficial both to these operators and to end
    users.

    ...

    This status code indicates that the server is denying access to the
    resource as a consequence of a legal demand.

You could get pedantic over whether or not this counts as a legal demand, but the example makes it relatively clear that "legal demand" here is fairly broad.

GDPR law does indeed make it illegal to serve certain web pages to EU visitors. If the operators are not willing to make amendments to comply with the law, then responding with HTTP 451 is the most correct thing to do. It doesn't mean the law is inherently bad, but it does mean that serving the request would be illegal, because that is how the law is written.

If this feels "completely inappropriate", then maybe it's because the modern web platform is completely ass-backwards in the first place. One must wonder why we're continuing to tolerate giving effectively static web pages so many privileges on our computers passively. I think browsers should flat-out start removing said privileges from websites that abuse them.

[1]: https://www.rfc-editor.org/rfc/rfc7725

It is illegal only if the website uses pervasive user tracking. Its like with cookie banners - they are not necessary if the site is not deploying the surveillance on the users.

Basically what you are saying is it should be illegal to load that page unless they change it. And it is illegal. They have no interest in changing the page. Therefore, they are preventing the page from loading as a result of legal reasons, not because there is any technical issue with loading the page.

I don't know how to break this to you, but that is the correct status code. They can be forgiven that they didn't make a second status code for "Page Can't Be Loaded Because It's Illegal But Actually It Should Be In Many People's Opinions".

I'm not in favor of pervasive internet tracking, but that doesn't change the reality: it is illegal for them to serve you that page. Putting it that way does make it sound bad, but what do you want to do, invent new words to make it seem better? It's what it is.

It still means the code is correct. It just means that there isn't some technical problem but intentional behavior, and there is some governmental policy at the root of it, rather than say a billing/account issue etc.

Saying "they could just not collect data" is like saying "they could just not show porn" or talk about Winnie the Pooh or whatever.

> It’s just a website that refuses to protect user privacy.

To be pedantic, they aren't refusing to protect privacy, they're refusing to comply with GDPR which requires more than just protecting privacy.

It could be that they just don't want to put a big dumb banner on their site.

You don't need a cookie banner if you respect users' privacy.

But you do need a GDPR specialized attorney to review all of what your doing even if you don't use any cookies.

Why? Even logging an IP address in a request log is creating records controlled by GDPR.

When TV news in the US is broke and only gets along because large companies buy up stations to control the news, its hard to justify spending tens of thousands of dollars on complying with laws from another continent.

> logging an IP address....

Untrue. IP is an category of PII but its not PII in itself unless you're a law enforcement.

Separately, if you log IP addresses you're doing it to prevent abuse and to provide security to your server, you're already permitted to do so.

More on that: https://missinfogeek.net/gdpr-consent/

That sounds like a great example of why you need a GDPR specialized attorney to review everything you do then…or just return status code 451 and call it a day.

Fair point, thanks.

To be pedantic some more, they used a HTTP 301 to get you to a page that uses a HTTP 200. It just _says_ "Error 451".

Thanks, and I wouldn't even classify that as pedantic.

Sigh.

I should have suspected that’d be the case.

Or more likely, they set up a temporary redirect 7 years ago thinking 'oh we need some time to figure it out', and promptly forgot about it.