You’re making my case for me. Of course that’s not the intent of the law, and it’s a bad law precisely because of unintended consequences, ambiguity, and unequa

You’re making my case for me. Of course that’s not the intent of the law, and it’s a bad law precisely because of unintended consequences, ambiguity, and unequal enforcement due to everyone being out of compliance in some way. But you keep just falling back on what they’re trying to do, which matters less than what they’re going to end up doing. What they’re actually going to end up doing is fail to really curb much abuse, introduce lots of costs and uncertainty, drive businesses out of the EU, worsen the UX of the internet, entrench the largest players who can afford to be mostly compliant and defend themselves legally, and further erode the concepts of national sovereignty and the ideals of the web. How about this: if EU citizens want more privacy protections than those provided by laws of my country, stop sending HTTP requests to my server in America and asking me to send information back to them. Why the hell is it on me to figure out where those requests are coming from and what bizarre set of laws that person’s country thinks I should have to care about with regard to what I do with the content that their citizen voluntarily sent me?