Has the US State Department stated a position on the matter?

The US State Department does not really get to have a stated position other than diplomatic.

Will I as a developer or US business owner need to proactively disallow all users from outside the US (since I am not familiar with their laws) to avoid potential legal troubles, or will other countries block my site/service without me needing to do anything?

If you are, they can drag you to court. End of story.

If you aren't then they will first rely on your cooperation and if that doesn't work, probably issue arrest orders which will make it a bit inconvenient to enter the EU for a while. And they'll probably tell ISPs to block you, yeah.

That analogy is what I take issue with. It's clear that Facebook, selling ads to European buyers, is doing business there. But is every random web site with a few European users? Does putting up a web site suddenly mean you're doing business in every country in the world, subject to the jurisdiction of all of them simultaneously?

"The US State Department does not really get to have a stated position other than diplomatic."

Diplomacy is what it does, and its diplomatic position on trade issues is relevant.

This seems like it would give a market advantage to Google, because they have products that people want and can likely get a fair number of people to consent if the consent was among useful consents. But smaller advertising companies would have a much harder time getting consent, especially if people don't recognize the name as providing anything useful.

And how does this apply to logs? It's common for web servers by default to record urls visited and IP addresses. Would that be legal without explicit consent?

I'm not certain on the details, but in eg Norway that is already much in line with the GDPR ip addresses are considered personal data, and as such regulated. However, there are provisions for storing such information for auditing purposes (both security, technical and financial/invoicing) - but would likely require explicit consent. ("i accept"/"i will not use this service" - more of an informational confirmation - like signs stating a shop is under camera surveillance - and you could choose not to shop the (even if: good luck finding a shop w/o surveillance cameras)).

In general "personal data" is anything that can significantly help identify a single individual (time/place, ip, phone number/date, address, full name, email, etc).

Ed: regarding logging ips for auditing - there's usually a fixed time limit. It's longest afaik for financial purposes (and the data storage directive explicitly states/stated minimum duration - effectively being lobbied into a tool to go after amateur copyright infringement by forcing isps to keep records longer than before). But from a data protection viewpoint, you can't say/get consent for "we log for auditing" and then keep the data indefinitely . More like 6 or 12 months.

Also, say, I want to collect data about the performance of the web application. Can that be collected, or does it require explicit consent as well?

Also rember that one of the goals is to avoid illicit linking - so being able to verify that ip n.n.n.n is the same as slow_hash(salt+other-ip) won't fly as "not storing".

In general, anonymizing data in sparse populations is tricky - where "small" can be quite large. Just imagine building a bitfield of variables like: sex,age +/-50;2 bits. Rough location (easily 6 bits), browser (2 bits), mobile? 1 bit - that's already 12 bits etc. See also NYC taxi dataset, eg (not the article I had in mind, but seems to cover similar points):

https://research.neustar.biz/2014/09/15/riding-with-the-star...

By the way: it's still a topic of heavy debate how much of this can be done through terms and conditions after all.

Disclaimer/source: working for large Google customer, involved in GDPR compliance. Edit: spelling.

How about this, what if I own a.com and embed an image from b.com (a completely different organization from me). And then b.com tracks the users' IP addresses, urls, referers, etc. Do I need to get permission for that? I'm not the one doing the tracking. Does b.com need to get permission for that? There's no opportunity for b.com go get permission, the user never is on a website controlled by them, there is never an opportunity to click an accept button for b.com . The user likely has never heard of b.com .

And how granular do these consents have to be? Would there be a page with 100 consent boxes, with a top box saying "accept all" for people too lazy to sort through all of the boxes?

(An Android ad blocker would probably work best, but getting one running on my ancient phone was more hassle than I wanted.)

I rarely see ads on my android (I do use ad blocker for Web browsing).

I have an incentive to block that as hard as humanly, or computationally, possible.

I see parallels to the 3rd class rail (or coach-class air) problem. If you improve the conditions of the lowest service class, nobody upgrades to higher levels of service. So the lowest class is intentionally bad.

Or substituting in first names of friends in paid content ("<person with same name as your friend> give the following reasons to vote x!/buy this").

Not to mention that if advertising works - then it undermines the idea of a free marked where purchases are made by informed independent agents (I think that's a fantasy anyway, but it seems to be a somewhat popular idea).

Is there anything inherently bad about a stalker passively observing and recording your every move, as long as they don't disturb your daily routine or pass the data along?

Even if you find the stalking behavior (cross-site tracking) of ad companies acceptable, there is a significant risk that your data leaks or is stolen. So, I should be able to decide who I trust with saving intimate data and who I don't.

My personal opinion is that there's no such thing as a "good" ad.

I guess companies can charge money for services that cost them money, and give you money if you enable certain services.

Of course, I don't see Facebook actually doing this, but just food for thought.

Article 7.4 "When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract."

Recital 43 "...Consent is presumed not to be freely given if [...] or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance."

Companies can deny services that cost them money unless you pay; but if you make "consent" as a condition for everyone then it's assumed that it's not freely given consent. You can deny service to everyone, but you can't require consent from everyone. That's not a new thing - that's exactly how the law works already regarding e.g. spam restrictions; you can have opt-in confirmation only if it's optional, if you make it mandatory to "opt-in" (e.g. deny registration unless the opt-in is checked) then it's not consent.

Also, even if you have consent, it can be revoked at any time (e.g. 5 minutes after the user received what they wanted), and you have to unconditionally remove the private information from your systems, even if you gave them a discount because they had "consented" at that moment.

Also, the customer may give you consent to process their data as such (e.g. include in your service) but object to their use in targeted marketing.

Article 21 (Right to object) "... (2) Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing. (3) Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes." - so it should be expected that even if you have consensually obtained the data, then you cannot use it freely, you can use it only for particular purposes; and things like EULAs can't override that.