> No, that's not the only requirement. At the very least there are additional record keeping steps, policies and procedures to draft, the appointment of a DPO t

> No, that's not the only requirement. At the very least there are additional record keeping steps, policies and procedures to draft, the appointment of a DPO that responds to requests for access or erasure That only applies if you illegally track users. You know what a simple solution to that is? Yup: Don't illegally track users. Pure magic, I know!