Totally agree that supporting GDPR is a good thing for WordPress, especially because so many organizations who have European constituents use WordPress.

However, I was disheartened to read the following disingenuous assertion (at least related to US organizations) which the best I can determine is pro-GDPR spin and not the actual facts (emphasis mine):

If your business is in the US or Australia or Israel but you have European users, you have to protect their data to European GDPR standards.

I had a long Twitter discussion with Heather starting here and I did my best to get clarification but she did not seem to want to acknowledge that GDPR is currently only opt-in for US companies and that US companies are not otherwise legally required to follow GDPR.

In general I am not against the GDPR and think that — all total — GDPR is a good idea. But I find it offensive when advocates of a policy (appear to do their best to) obfuscate facts and try to make people believe that their position is a legal requirement when in fact it is just an option.

I know many people prefer "Alternate Facts" to be reality these days, but I still believe real facts matter.

P.S. If you think following the GDPR should be a legal requirement for US organizations, then contact your Senators and Congresspeople and ask that they make it so. Until then, let's stick to the facts.