In my mind, the right to be forgotten is implied by your bullet point "Let users clear way to tell company that they want to stop using their account (and relat

In my mind, the right to be forgotten is implied by your bullet point "Let users clear way to tell company that they want to stop using their account (and related data gathering)" By the definition of data processing, streetlend has to delete all my data to stop processing it. It is pretty clear what streetlend needs to do to be GDPR compliant: if the user data is actually being sent to the third parties (the ad networks) then users need to explicitly be told this. If the data is not being sent to third parties then users already consent to their data being stored by entering the data (the data is necessary for the performance of the service operated). Next to that: allow users to delete their data when they close their account (this should be as easy as setting cascade on foreign key constraints). As for the geography: if your interaction with European citizens is incidental and not purposeful, you cannot be charged under the GDPR. It is only if you are actively trying to target your goods or services to the European market that they will enforce against you. This is obviously the case since they will have no power to enforce the law otherwise, but it is also covered by the three paragraphs of Article 3.