I’ve been in the room when a very expensive lawyer couldn’t reliably predict if an almost brochureware website was compliant because the multi-tenant web server

I’ve been in the room when a very expensive lawyer couldn’t reliably predict if an almost brochureware website was compliant because the multi-tenant web server it was sitting behind was logging IP addresses for anti-abuse purposes. Now it’s my belief that it was compliant but guess what is less risky than trusting my beliefs? Blocking European access. You can wish GDPR doesn’t have compliance costs but that doesn’t make it true.