In reply to Carl Hancock.

I would say given the fact the EU could attempt to fine the site owner in Brazil for not even knowing what the GDRP is in order to be able to configure his site to be GDRP compliant in that scenario, that it would indeed be burdensome.

Look, I have no issue with data privacy. I have no issue with doing what we can to provide tools to help with GDRP compliance. We will most definitely do more in this area. BUT just like I think it’s burdensome to citizens in other countries when my own country (U.S.) tries to apply U.S. laws to citizens outside of the U.S. when something is not obviously illegal (ex. cocaine trafficking is obviously illegal no matter the country), I think it’s crazy for the EU to do the same.

It becomes very dicey to attempt to enforce it internationally and introduces a burden on citizens of other jurisdictions to be up to date with EU laws or risk being exposed to legal action for something they wouldn’t even know existed.

If the EU GDRP rules were not being applied internationally and only applied to EU based businesses and site owners I would have a different opinion on this. But that is not the case.

Ultimately my opinion doesn’t matter. As I mentioned we will do what we can to provide tools for site owners to help mitigate this risk. These tools actually already exist via existing plugins, hooks/filters, documentation, etc. That is one of the beautiful things about open source. But ultimately the onus is on the site owners to actually implement them. Good luck with that one.