> I really think that all of you who are salivating at the prospect of the GDPR destroying FB should prepare yourself for disappointment.

That's got to be the mother of all strawmen. FB will not be destroyed by the GDPR, but - ideally - the GDPR will cut back some of the worst excesses such as tracking users who are not even members of FB through embedded JS on other people's properties.

> It's a bad law, because it's so overly broad and vague that it's going to be impossible to be fully compliant.

It's actually a pretty good law compared to the predecessor.

If you feel that it is impossible to be fully compliant then maybe you need someone to interpret the law for you - such as a lawyer or a judge -, there are some fields of tension but on the whole it is not at all impossible to be compliant at least with the spirit of the law. Acting in good faith is a good first step.

> For example, an EU resident hits your server while they're on vacation in Australia. You've stored analytics, IP addresses, etc. Congrats, you're now in violation.

Contrived example, do not pass go.

> That's the tip of the iceberg. The law also broadly contradicts loads of other laws about how data must be retained for legal and compliance purposes.

And makes special mention of that and has exceptions for those cases.

> So now that everyone is breaking this law, regulators are free to just decide who they want to punish and how much. That's incredibly damaging to the fundamental idea of the rule of law.

Except that's not how it works, which makes this another strawman.

> 2. It sets a really bad precedent regarding jurisdiction and the internet.

How so? If you want to argue something is bad then you need to show how it is bad because of negative consequences, what 'any jurisdiction in the world' declares is their business, but the EU has stepped up for the rights of its citizens, and as one of those citizens, I'm pretty happy about it.

> So now any jurisdiction in the world can declare that if you do something they don't like that even remotely affects them, you owe them whatever they want.

This has nothing to do with the GDPR.

> What if some oppressive regime passes a law that if your website is shown to one of their citizens and doesn't have a message praising their leader, you owe them 100% of your global revenue in perpetuity.

Yet another strawman.

> Why not?

Well, why not? Indeed, except, it hasn't happened.

> You've violated their laws regarding behavior towards their citizens!

Yes, and you're free to ignore them, except in those cases where you wish to have a business presence in the country of said oppressive regime.

> 3. As item #2 gets at, countries can pass whatever laws they want, but they're limited by their ability to enforce those laws.

Exactly. But the EU can and does enforce its laws.

> If the EU gets overly broad and punitive here (as I'd argue they have), then companies will either just leave, or shift their digital operations to jurisdictions where courts can't enforce those laws.

That's fine, at least we have proven malicious intent on their part then. Complying with this law isn't all that hard. But it is hard if you are coming at the whole concept of privacy as a party that does not care about it.

> Ultimately, I think that the realistic path here is that Google and Facebook will fundamentally change almost nothing.

We'll see. My guess is that they like the money too much to do 'nothing'.

> The user experience will just get worse, because we'll have to constantly be agreeing to a long list of terms about how our data will be used, etc, etc. And people will just agree and move on.

So what are you worried about then?

> Regardless, the idea that we're suddenly going to live in a new golden age of digital privacy because the GDPR has good intentions is laughable.

Nobody claimed that, could you please lay off the strawmen, you can do much better than that.