Similar measures have been implemented in a number of european countries for years, I think originally in France. As far as I am aware, GDPR only standardises these laws and applies them to all EU states. Plus it adds a fine large enough for companies to actually care.

The fines are indeed substantial: up to 4% of annual turnover. On top of thay they can force you to shut down the service in question until remediated. For an e-commerce company that can be even worse than the 4%.

Being fully compliant with GDPR is a mountain of work even if you thought you were doing all the right things before.

In practice, small companies/ start-ups might not be audited / reported / pursued very much but: a) you'll never know and b) at least all the big tech and e-commerce companies are smack on in the sights of several data protection and competition(!) authorities already. We're all scrambling to be compliant in time.

Source: first hand account from running the GDPR compliance project in e-commerce company.

The fine is actually 4% of global annual revenue, or EUR100,000, whichever is greater.

Oh fair point. I propose we all start calling the 100kEUR minimum the "start-up clause". ;)

Try it. It is not available.

For the moment not possible.