GDPR is a headache, not gonna lie. I recently made my site GDPR compliant by having zero requests to other domains and zero cookies set until the user provides consent through the cookie notice. I removed Jetpack, Google Analytics, Gravatar, etc, and put AdSense behind the cookie notice (loads only if user consents). My implementation was custom made because I didn’t want to pay for a third party service and make my site slower with their bloated plugin. Turns out AdSense didn’t like my implementation, thought it was shady, and closed my account. There was nothing shady going on – by default ads were non-personalized and also paused. If user consented, adsbygoogle.js would be loaded, personalization turned on, and ads would be unpaused.

Oh well. Never made much from AdSense anyway. But the thing is, even with all the changes, my site still may not be GDPR compliant because it uses Cloudflare. I simply cannot do without Cloudflare. So while loading the site doesn’t connect to any other domain, it still gets processed by Cloudflare and my web host (which isn’t in Europe).

On the plus side, my site is now extremely fast, if a little more drab than before. I also removed the cookie banner as there was no need for it after AdSense kicked me out.