It only takes a quick scan of the comments in this thread to see that there were people who received this email while hosting a static github.io website with th

It only takes a quick scan of the comments in this thread to see that there were people who received this email while hosting a static github.io website with their personal blog. That's a public website. Do you honestly think that anyone running a personal blog has no business doing so unless they are knowledgeable about the details of European and California website privacy rules? What a brilliant way to stifle public speech. Your answer will probably be: "personal blog don't fall under these regulations, so it's a non-issue" but that's exactly the point: these researchers scared a bunch of people into spending time to research a law that doesn't even apply to them, yet the chance that some random from Europe would send a GDPR request to their blog is essentially zero, because even privacy crusaders are smarter than these Princeton research to know that it makes no sense to do this. Even if the general principle were ethical (not that I agree), the Princeton researches should have used a curated list of websites that could reasonably be expected to receive GDPR requests.