I used https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://en.wikipedia.org/wiki/General_Data_Protection_Regula... and https://iapp.org/new

I used https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://en.wikipedia.org/wiki/General_Data_Protection_Regula... and https://iapp.org/news/a/top-10-operational-impacts-of-the-gdpr-part-3-consent/ https://iapp.org/news/a/top-10-operational-impacts-of-the-gd... Easiest way to comply is not storing any identifiable data unless absolutely necessary for your service. You can still collect anonymous statistics if you apply techniques like k-anonymity to make sure you can't deanonymize it. (https://iapp.org/news/a/top-10-operational-impacts-of-the-gdpr-part-8-pseudonymization/ https://iapp.org/news/a/top-10-operational-impacts-of-the-gd...)