I think you're thinking of this GDPR thing as two sides fighting each other, and you're there in the middle with this reasonable compromise. But you're wrong :

I think you're thinking of this GDPR thing as two sides fighting each other, and you're there in the middle with this reasonable compromise. But you're wrong :) You're actually on the same side as most of the anti-GDPR arguments I see. Rather than speak for everyone, I'll just state my case: I like the intent of the law, and I don't like my privacy or anyone else's being violated. I'm fine with reasonable regulation to prevent that. But the GDPR is legitimately terrible regulation. It's overly broad, vague, has the potential for huge penalties, is anti-small business, tries to establish the entire globe as being within its jurisdiction because someone from the EU might stumble across your website, and expects us to just trust that regulators from 28 countries will forever be gracious and helpful instead of capriciously punitive. If the GDPR was restricted to company with an actual presence in the EU and above a certain size, I'd be fully in favor of it. I'm not sure I'd think it's smart, but the EU should do what it thinks is right for its citizens. But instead the GDPR claims that my side project on a server in Alabama (hypothetical) is a violation of their residents' human rights worth a fine up to millions of Euros depending on the whims of 28 different regulatory agencies (yes, I know they almost certainly won't fine me millions, but this law leaves it up to them to decide). But the reason the other side disagrees is because: a) they trust the regulators, and b) they see any collection of anything remotely resembling "private data" as a fundamental violation of their human rights. Under that set of assumptions, why would you let small businesses off the hook so they can be free to violate anyone's human rights as they see fit?