Is this website intended to make money for its operator? If so, how much money is it expected to make? The current answers speak of "businesses", but it is not clear to me that this website is a business.

No, the website is not intended to generate any money. Use of the website and its service will be completely free to all users. At some point in the future it may be necessary to add some sort of advertising to the site (e.g. AdSense, etc.) to help offset server costs; I'm not familiar with how much AdSense would generate--if it covered the monthly server fees, I would be very surprised. Although this is a personal endeavor not designed to make money, I did recommend my friend register an LLC for this project. Perhaps that was bad advice in the context of the GDPR stuff?

@Charles a person who operates as a sole proprietorship, that is, without creating an LLC or other legal entity, is also a business.

@Charles GDPR obligations will not be any different for a sole proprieties as opposed to an LLC, and not much different for a large corporation.

Food for thought for those providing answers: What's the likelihood of an EU regulator going after a small, non-commercial, foreign-operated project? What's the likelihood that a foreign court would enforce the EU penalty, especially considering EU users were expressly prohibited via the TOS? How would an EU entity/regulator know said project does not comply with the GDPR without accessing it, which would be breaching the TOS & circumventing the geo-block? If they intentionally did so, in order to prove GDPR non-compliance, would there be grounds for counter-suit for violating the TOS?

What are the headaches he wants to avoid? Processing personal data for a defined purpose, and allowing access to that data and its deletion, do not appear to be anything but simple good practice.

Do note that he should then also block countries like Japan, Canada, Brazil, Israel, Kenya or Argentina (and I am probably forgetting a bunch). It's definitely not a majority of the world (yet), but privacy laws are far from rare. Being really careful with what you collect (the absolute minimum you need) and not doing anything shady with it makes a lot more legal sense than trying to block any users from countries that protect their people.

Your question starts from a wrong assumption. As a European user I very much prefer to be excluded by certain sites than give up the protections of the GDPR. If you really asked for an opt put you would probably attract only users willing to provide a fake identity.

@AndrewLeach The GDPR does encompass several good practices that existed decades before GDPR (e.g. protecting data with encryption, allowing users to delete their information, etc.) Not so good practices include treating an IP address as personal information, expecting user content to be removed after user deletes their account (consider a forum where a user contributes to a discussion. After removing the content, the discussion no longer makes any sense because content was removed when the user deleted their account), etc. etc.

@Charles you don't need to remove user generated content, you only need to remove PII.

@FishSaidNo re: "If they intentionally did so [...] would there be grounds for counter-suit for violating the TOS"... Do you mean I can just write in the TOS of my website "If you are FBI or any other LE officer you are prohibited from accessing this site"?

In my opinion, the onus of using a GDPR/CCPA/etc. enabled site needs to be on the user. Meaning, if a user wants a particular formal privacy standard, they should use only sites that advertise certification for such standard (usually easily identified by the plethora of popup notices that appear when first visiting the site) This is in contrast to the ideology that all sites must implicitly be compliant with all the various privacy standards throughout the world. Of course this approach still creates an advantage for large business (they can afford the attorneys to support them all)

@SCP-738 DavidMulder Sadly, blocking those regions seems to be the new path forward for individuals/small businesses offering services. Blanket banning people is not how the internet should work. The onus as to use/not-use a site should be on the user. If a given site doesn't offer compliance with the desired privacy directive(s) then don't use the site.

@FluidCode For my sites, I don't care if a user provides fake information. I have absolutely no interest in who they are or where they live. Their email address is verified for account recovery purposes, but otherwise I don't care about their email either. Now for (e.g. a online dating website) legitimate users will want to provide truthful information about themselves (photo, name, etc..) That is data that would be deleted when they delete their account. Regardless, I'm happy you're not upset by the blanket geo-blocking. If I lived in EU, I would NOT be happy.

@AndreaLazzarotto thanks for the clarification regarding user content vs. PII. If a user discloses PII in a post they publish, is the post still exempt from removal because it was published by the user?

@AndreaLazzarotto regarding blocking entities via TOS- I don't care who accesses my sites as long as they acknowledge my site is not GDPR/CCPA/xyz policy certified. (I've been doing many thing the GDPR requires for decades -- e.g. encryption of data, user account deletion, etc.) but not everything (treating IP address as PII, etc, etc.) The onus to use or not use my site is on the user.

@Charles I understand that many sites that do not want to implement the GDPR do not intend to abuse the data, but simply want to avoid some hassle. But as a user I have to take into account the worst. I know that with my IP and the help of Google analytics it is possible to fully identify me even if I provide fake data and the data one would provide to a dating site are quite sensible. Therefore I very much prefer to be excluded from such services and I can bet a lot of other European users share my opinion.

@AndreaLazzarotto That would be a targeted restriction of access based on occupation, not quite the same as a blanket geo-ban (the sole point of which is to make it as clear as day that the service is not intended for any users in that region). The reason some (typically small operations) resort to such drastic action is to avoid a potential €20,000,000 penalty being imposed by some foreign authority in a jurisdiction of which they have no presence; not that they have unethical intentions for the data. Despite this, furthering consumer privacy is a great thing imo & GDPR does get a lot right.

@Charles Putting the onus on the user is a typical capitalist response, after all, that's exactly how the internet initially worked and look at where that got us. Companies are highly motivated to link 'loss of privacy' to 'product' rather than 'specific feature'. What GDPR does is make each individual privacy choice separate and force companies to put some minimal time in thinking about what they are doing. It's sincerely not hard to comply. (Tip: ico from the UK gov has an amazing guide to GDPR)

@DavidMulder You are correct that I do value the freedom to choose above all else. If a company doesn't handle privacy in a way you approve, DON'T USE THAT COMPANY. Then watch the company adapt because they don't want to lose sales.

@DavidMulder with regards to "that's exactly how the internet initially worked and look at where it got us" -- my point exactly -- the INTERNET is a huge success precisely because of that capitalist freedom.