The whole, "everyone globally must comply" if your site has the potential for EU citizens visiting it is downright silly. There's no jurisdiction or enforcement mechanism for this outside the EU, Tim's hypothetical scenario above notwithstanding. Just watch. It'll be the same as the whole "every sale to an EU citizen must include VAT" scare that went down a few years back. No enforcement mechanism means no VAT is collected from the US organizations unless they have an actual EU presence. Go figure.

That said, if your organization does have a physical presence in the EU, or does a significant amount of work for hire for EU companies, then compliance isn't really optional.

Personally I find this whole thing ironic because in order to prove that our organization is in compliance with this "privacy" law we now need to collect and store more personally identifiable information than we did before. Without it we cannot prove that an individual requested to hear from us, should we ever be challenged. So in our case the law is pretty much doing the opposite of what it purports to do. Go figure.