I've never heard it expressed this way, but GDPR is essentially a tax on collecting data. Not in a revenue generating way, but definitely in a "discouraging behavior" way. It increases costs for companies to collect and store user data.

It’s ridiculous that a one person startup with no revenue has to spend time dealing with GDPR regulations. This should have been structured to deal with the kinds of entities that lead to the law being written in the first place. This is only going to tax small startups and stifle innovation, giving an even bigger moat to the large incumbents. The road to hell is paved with good intentions...

It was one data scientist at Cambridge who supplied Cambridge Analytica with the data for 50 million facebook users.

The size of the company doesn't matter. One person with an API and a database can do as much damage as a massive company.

No, the way GDPR is written, the cost is null for most small startups in europe. And for the startups in need of personnal data, either the ammount of data that need protection is small (like a birth day field) and will need at most ~4 day (counting deployment) to be corrected, or they are working with state-related business (at least in France).

Source: i'm currently paid to create ML and data analytic clusters for startups and to give some advices on regulation.

Not collecting data is cheap and easy!

I assume you don’t run a web startup.

I look forward to using GDPR to solve nasty technical questions about data retention and sovereignty. Like many saas companies, we probably tend towards keeping data around in case our customer can make use of it at some time in the future. Now we'll be able to just be more hard core about not retaining data "just in case".