Thanks for the explanations. I had heard rumors GDPR was a fiasco, but didn't realize how bad it really was. I've shared all these responses with my colleague. I was hoping there was a straightforward way to preserve EU access, but I fear all I've done is expand his list of geoblocks/TOS bans to also include territories that have their own GDPR-like policies (CCPA, et. al)

I've been reading these responses with great interest for myself as well. I'm also an engineer with several web-based projects I'd like to eventually make available to the world (some commercial, some free). Unfortunately, time is often scarce and seeing all this legal red-tape isn't particularly exciting. Based on these responses and other research, I think I'd be most inclined to ensure I'm not targeting any restricted region and call it good. (I guess geoblocking could be a way to document I'm not targeting a region, but the Internet is meant to be collaborative not restrictive)

@Charles Will you or your colleague have the same approach to taxes, banking, intellectual property, licensing and fraud regulations, the terms and conditions from app stores, payment providers, advertising networks, cloud providers, etc.? Running a business does imply a little bit of complexity and not every business idea is legal.

@Charles From an EU perspective, GDPR is far from a fiasco – it's a great simplification because now I only have to target 1 set of rules instead of ~30. But non-EU websites didn't pay attention previously, and true compliance can be tricky+costly, like appointing an Art 27 EU representative. So I understand your frustration. The US' lack of comparable federal privacy laws will increase costs through fragmentation. For a small service without geographic focus it will typically be OK to focus on your home jurisdiction, or you could allowlist locations where you've prepared compliance.

"doesn't distinguish between controllers that are entities/LLCs and controllers who are natural persons" The GDPR does not apply if your activity is done for personal or household purposes.

@Relaxed This question is in response to a colleagues free web-based service offering. There is no payment collected to use any part of the service and so there are no taxes. The service is an honest charity offering with no intention of fraud or other unethical behavior. In a for-profit/business setting taxes and other obligations would definitely be handled by an attorney.

@amon Thanks for your answer and comment. The more I read about GDPR, CCPA, and the other privacy legislation, the more I feel that the onus for using (or not using) a website must be on the user. If a site advertises GDPR certified, then users can choose to use that site knowing the expectations. However, if they use a non-GDPR site they know that also. Since there are so many policies for the various legal geographies, it would almost be better to certify each policy trait separately (e.g. PII is encrypted, ability to delete account supported, ability to remove all content supported, etc)

Of course the large corporations will still have the time and money to call out the specific policy names (GDPR, CCPA, etc.) but the users will at least be able to see what the site is doing for their privacy.

@AndreaLazzarotto GDPR doesn't apply if the processing activity is done for purely personal or household purposes. Precedent suggests that this word “purely” requires a fairly narrow interpretation of that exception. For example, the Lindqvist case showed that a person running a blog about her social life was not covered by this exception. I wanted to mention “natural persons” because some people mistakenly believe that charity work, partnerships, or sole proprietors would always be exempt.

@Charles I empathize with your position, but from a regulatory regime perspective it makes no sense. Companies can't opt-out from GDPR, just as they can't opt-out from taxes, environmental regulations, or consumer protection laws. This is about protecting a public good, not just individual rights. It also makes no sense to allow users to opt-out from those protections, since such opt-out could be improperly coerced. But, and I cannot repeat this often enough, GDPR simply might not apply in your scenario, so that any EU regulations are moot. Similarly, I happily ignore Iranian morality laws.

@Charles It makes a difference but my point is larger. Consider libel or copyright then, laws apply to free services too and publishing creates its own set of liabilities. Looking for contorted ways to opt out of the law is not the right way to approach it.

@amon Relaxed I'm trying to understand your points, but it just isn't registering for me. The world has numerous legal jurisdictions with drastically different laws (as per your Iran example) I'm going to ask a separate question to try and gain a better understanding.

@Muzer No website is mandatory. GDPR is not necessary. Watch for the next major data breach and I'll bet you it is an organization that claimed GDPR compliance...