>1. It's a bad law, because it's so overly broad and vague that it's going to be impossible to be fully compliant. For example, an EU resident hits your server while they're on vacation in Australia. You've stored analytics, IP addresses, etc. Congrats, you're now in violation. That's the tip of the iceberg. The law also broadly contradicts loads of other laws about how data must be retained for legal and compliance purposes. So now that everyone is breaking this law, regulators are free to just decide who they want to punish and how much. That's incredibly damaging to the fundamental idea of the rule of law.

Well yes, you're in violation. You've violated the rules. There are two easy solutions to this problem: separated datacentres for your EU customers so that their requests don't even touch the servers set to VILE_PRIVACY_VIOLATIONS=1, or just following the EU rules with respect to all customers.

Oh no, they might inadvertently force you to respect the human rights of people outside the EU too! How horrible!

It's not damaging to the idea of the rule of law to have regulations that are broad and require many parties to take action. Lots of companies are working very hard to ensure they comply with the new rules. Everyone else can do so too.

>2. It sets a really bad precedent regarding jurisdiction and the internet. So now any jurisdiction in the world can declare that if you do something they don't like that even remotely affects them, you owe them whatever they want. What if some oppressive regime passes a law that if your website is shown to one of their citizens and doesn't have a message praising their leader, you owe them 100% of your global revenue in perpetuity. Why not? You've violated their laws regarding behavior towards their citizens!

That's not a new precedent at all. If you want to operate within a particular jurisdiction then you have to comply with the laws of that jurisdiction. If you want to operate in Canada, you have to follow Canadian law. If you want to operate in the United States, you have to follow US law. If you want to operate in New Zealand, you have to follow New Zealand law. And if you want to operate in the EU, well, yes, you have to follow EU law.

If North Korea decrees that any website that says anything negative about their Dear Leader will be in violation of their laws and must pay them 100% of their global revenue in perpetuity then people just won't operate in North Korea. Big deal. They already probably don't operate in North Korea. The directors won't be able to go there on holiday without being arrested. Oh well. Who cares? That's North Korea's loss.

>3. As item #2 gets at, countries can pass whatever laws they want, but they're limited by their ability to enforce those laws. If the EU gets overly broad and punitive here (as I'd argue they have), then companies will either just leave, or shift their digital operations to jurisdictions where courts can't enforce those laws.

The EU can enforce their laws regardless of where your 'digital operations' are located. If you have EU customers, you are operating in the EU. You're subject to their laws. You're subject to their tax laws. You might try to get around it, but you won't. Oh you might get away with it for a while, but then the director of your company will go on a holiday to France and be arrested at the airport. Or you'll be extradited from the United States to the EU. Or, most likely, the US regulators that have already agreed to enforce the GDPR within the United States will just do so, without you having to actually go to Europe at all.

If these companies want to actively block all connections from the EU and miss out on 500 million customers then good luck with that. I'm sure that cutting off half a billion people in some of the world's richest economies will work out really well for them.

>Ultimately, I think that the realistic path here is that Google and Facebook will fundamentally change almost nothing. The user experience will just get worse, because we'll have to constantly be agreeing to a long list of terms about how our data will be used, etc, etc. And people will just agree and move on. Look at the cookie thing. Yes, I know you think it's different this time because of X, Y, and Z, but I'm skeptical. We'll see.

Nope. You cannot contract these rules away, just like you cannot agree with your employer to ignore some aspect of employment law that you don't like. That's sort of the whole point, after all. If you could just contract these obligations and rules away they'd be pointless.

The cookie thing is completely different because it didn't ban you from tracking cookies, it forced you to notify the user if you use tracking cookies. Well, that's what those banners do. I personally think they're useful. It hopefully makes people at least think twice about whether they actually need to use a cookie or whether their website can actually function fine without them.