The best part: > Under EU data protection law, therefore, a European retailer and the US platform are jointly responsible for gathering the data I really hope

The best part: > Under EU data protection law, therefore, a European retailer and the US platform are jointly responsible for gathering the data I really hope this means that Facebook and all those stats/ads providers can be held responsible if they don't take adequate measures to ensure that only data from users who have given valid consent is sent. Going after individual site operators is a fight against windmills. It would be much more effective if they could go after a company that provides an Ad SDK to hundreds of thousands of apps, but just tells the app developers in the fine print "by using this SDK you confirm that you have gotten consent from your users" - and as a result, knowingly accepts that nobody will care and data from non-consenting users will be collected.