Easy: Don't collect/store personal data without opt-in consent (which I think is totally reasonable). Like... if it's your hobby website and you don't store per

Easy: Don't collect/store personal data without opt-in consent (which I think is totally reasonable). Like... if it's your hobby website and you don't store personal data without telling your users about what you're storing and what you're doing with that data... you're fine. Also if they ask you "what data do you have on me?" and "can you delete the data you have on me?", you respond and respect their request like a reasonable human being - it's their data after all. It's... really just not a big deal for small-time projects. The whole total compliance thing is a CYA thing but in reality even if you did anything wrong, you'd be contacted about it first in order to resolve it. You could then deal with whatever issue came up (didn't tell users about X? start telling them.) and move on with your life. It's only if you ignored warnings and kept being shady that it'd escalate.