I get that laws and enforcement vary -- but companies which expose things to a broad and presumably international audience seem to be settling on a set of best

I get that laws and enforcement vary -- but companies which expose things to a broad and presumably international audience seem to be settling on a set of best practices. You mention making a business outline. In my professional work, I'm familiar with e.g. details of data retention in a GDPR context being based on a business use, rather than just a preference to keep things. But ... sometimes the use isn't about business, and the law seems to regard that as not legitimate. Earlier this summer I created a hobby site, which is all static content, but which includes a google analytics snippet. I really just wanted to be able to measure visitor numbers, file downloads, etc. The question "Are people even viewing the thing I published?" isn't intrinsically a business concern. I don't even really have records of any PII -- just some analytics and graphs of aggregate behavior. Nor do I have the ability to delete anything should a visitor request it. But my understanding is I'm nevertheless obligated to have a policy, a data controller, etc, and if someone does issue a GDPR related request, I'll perhaps respond by taking down the whole project. Which seems like a crazy situation.