In reply to Miroslav Glavic.

From my understanding, and I'm certainly no expert, GDPR is a lot stricter than anything the US currently does - so, covering yourself with the GDPR is a good base to start from.

If any of your users are from the EU then you are expected to abide by the GDPR. How can they enforce that if, say, you're in the US? They can't. BUT any third party you deal with that is from the EU can be fined for your lack of coverage - hence you'll see such third-parties starting to ask you for details of what you're doing about the GDPR.

There's really only 2 ways, I see, you can avoid GDPR - successfully Geo-block all EU citizens from your site (gonna be difficult due to VPN) or never deal with any third party from the EU. Except, the GDPR is not onerous - it's a fair set of rules about user privacy.