As I understand it, you need to provide a functional way to opt out of tracking, and access to a service must not be blocked if you do not opt into the tracking

As I understand it, you need to provide a functional way to opt out of tracking, and access to a service must not be blocked if you do not opt into the tracking. There's a bunch of other stuff (i.e. if you request the data a website has on you they have to hand it over, and if you request your information be deleted they have to actually do it within reason) but that's the gist of it. Naturally, this results in a bunch of sites geoblocking European users- why would any sane person or company spend server time on people who can no longer legally pay you for accessing it? But then again, protectionism is one of the two main goals of GDPR (the idea is that EU folks will be forced to read European sources that follow EU law); the other is getting American tech companies to pay their taxes in a way they can't just dodge by moving to Ireland. Privacy's just the fig leaf over it all- while it's a nice side-effect of the law it most certainly was not the primary goal.