Well, from my POV, the biggest GDPR technical issue is integrating with Google. They don't support TCF 2.0[1] like nearly everyone else in Europe, so we have to

Well, from my POV, the biggest GDPR technical issue is integrating with Google. They don't support TCF 2.0[1] like nearly everyone else in Europe, so we have to special case them. Other than that, we've had to a) ensure we honour user consent b) ensure that only directly relevant PII is held in our systems c) for only as long as needed and d) is handled securely - so ensure encryption at rest and in transit is properly applied. Was maybe about 2 months work for 3 people to put in place, and we had plenty of time to do so. Oh, and an initial early change we made at the behest of our lawyers was to drop the last quartet of any stored IPs. Not sure if that was GDPR or another EU directive though. [1]: https://iabeurope.eu/tcf-2-0/ https://iabeurope.eu/tcf-2-0/