(I am only describing the situation in Germany) I can say from my own founding experience that you want to avoid being investigated, at least in Germany. While

(I am only describing the situation in Germany) I can say from my own founding experience that you want to avoid being investigated, at least in Germany. While I am a big privacy fanatic, the current way rules are implemented is quite labor intense for small founder teams. As a matter of fact, cookie laws will be your most benign issue to solve. The biggest challenge is that most tech startups that deal with personal data need to appoint a certified privacy officer, which can be ridiculously expensive.