Ugh, I feel like this is a common and overly simplistic take. While it's definitely true that GDPR is harder to comply with if you're doing a ton of evil shit o

Ugh, I feel like this is a common and overly simplistic take. While it's definitely true that GDPR is harder to comply with if you're doing a ton of evil shit or selling user data, it can definitely be quite onerous to comply with even if you're not. The company I work for (Teachable) is a specialized site builder for course content. We make all of our revenue from people either paying us directly for a plan, or transaction fees on people buying from our customers, no ads or data selling. Nevertheless, complying with GDPR still took well over a month of some of our best engineers time. Even if you don't sell data, the odds you had a plan prior to GPDR for how to handle right to be forgotten - how do you delete PII (which is defined broadly, including ip addresses) from db backups without ruining their integrity? If you use something with an immutable log, like Kafka, how do you remove the data there? Etc, etc