In reply to Mike Schinkel.

Sorry, Mike, you're a great developer, but you're not so hot as a lawyer!

First, you confuse Privacy Shield (which is indeed opt-in) with the GDPR (which is not). In fact, Privacy Shield is supposed to be a vehicle for ensuring compliance with the GDPR. (Whether it actually does enough to achieve that is another question; its predecessor, Safe Harbor, did not). But the GDPR remains mandatory.

Second, your points on Twitter didn't get the definitive answer you wanted because you weren't asking the right question. You kept asking about enforcement. But that's not the same thing as whether the GDPR applies to US businesses with European users.

Just because a motorist repeatedly exceeds the speed limit without getting caught doesn't mean that there is no speed limit.

In fact, there is no doubt that the GDPR does apply to US businesses with European users. That's not a so-called "alternative fact," but a real fact. (I do hope that every time someone doesn't get an answer s/he wants, they don't now resort to yelling "alternative fact." That will get old really fast. And it's quite misleading here.)

There are many ways that the GDPR might be enforced against a US business, just as there are many ways that European governments might seek to collect VAT from US businesses that sell to customers in the EU. How they choose to do so is up to their imagination (not Heather's).

I know it's nice to think that Americans are governed only by rules made somewhere within US boundaries. But, when they do something that affects people in other jurisdictions, the laws in those other jurisdictions often apply too.