I think this is a forest and trees situation. Using things like Cloudflare, alternative niche "privacy conscience" trackers, adding GDPR popups, etc. are all wa

I think this is a forest and trees situation. Using things like Cloudflare, alternative niche "privacy conscience" trackers, adding GDPR popups, etc. are all way above an beyond your average website operator's abilities or understanding. The dude trying to sell custom T-Shirts has a website because it's a necessity to sell T-Shirts, not because he enjoys operating, optimizing and customizing websites. He just wants to sell more T-Shirts, and some European Union law isn't going to give him pause even for a second if he is physically not in a EU country. While good intentioned, the GDPR was specifically designed to be a "viral" law and force the entire internet to comply... unfortunately the EU's long arm of the law is fairly short. Further, the EU's ability to enforce the GDPR is limited to businesses physically under it's jurisdiction - ie. the US is not going to extradite some website operator for an alleged GDPR violation, no matter how severe the case may be, and the EU can only fine a business into compliance if the business cares about EU laws (which would imply a physical presence in the EU). Ignoring the GDPR is the right move for most websites. If people desire comprehensive, impactful privacy guarantees, then a similar law needs to be passed within the US.