Size threshold is presumably to allow small startups to grow and explore models without crushing compliance costs. That’s the kind of regulation that protects incumbents who can afford the lawyers and software tools to do compliance properly.

There tends to be an inverse relationship between regulation in a space and incumbents springing up, for better or for worse

There's a fine line between "grow and explore models without crushing compliance costs" and "break all the rules so you can outcompete established players". Hi, Uber!

Correctly handling user data is much cheaper if you bake it in from the start. The real costs are in figuring out how to follow GDPR when you already have private user data saved all over the place and suddenly need to be able to do things like permanently remove all identifiable information for a single user.

It isn't a huge loss if we no longer explore models that require violating privacy protections to get off the ground.

The overhead cost of compliance with something like GDPR would probably kill most small startups that had a data-backed business model.

There isn't really that much overhead, especially if you keep the GDPR in mind from the beginning. The big costs happen at older and larger companies that had very lax procedures before.

I bet it will not inhibit startups in the EU.

To some part I think the GDPR is intended to make it easier for startups in Europe to compete with US services on the EU market.

In recent times, being a privacy-aware service is a selling point and the EU services can easily advertise as being privacy-first to US citizens while US companies will have trouble doing so (considering SESTA/FOSTA and CLOUD act)

Do we want startups to have a "data-backed business model"?

Yeah we do. While I don't like Google tracking where I am from my cell phone when location-sharing is off, I love listening to music on Pandora and Spotify and I would never discover the new songs I do if there was no option to like or ban songs and evolve the station.

I don't see how either of those are "data-backed business models". Pandora/Spotify have a very clear draw for people which exists regardless of how much data they store on people. They absolutely can and do use data to _enhance_ their core offering, but if they stopped overnight it would not cripple their business immediately.

Both aslo offer a very clear service, (streaming music) and both only really collect data to improve your music experience.

Facebook seems to grab whatever it can, just to make money.