There seems to be a strange friction between this statement and the reasoning behind it. You say GDPR's restrictions on collecting more information than necessary or storing it longer than necessary would prevent Facebook from functioning as a social network — but if that's the case, then it sounds like the data collection and retention was necessary after all. Am I missing something here?

The problem is that we don’t know. It doesn’t specify a definition of necessary. Necessary for whom? It isn’t necessary for Facebook to solicit people to make wall posts, so arguably they’d run afoul of the law by simply offering the option to do so.

My point was that the law leaves massive room for interpretation. The threat of aggressive application and interpretation of this law could deliver significant leverage to the EU over these companies in matters reaching far beyond privacy.

> The GDPR version of Facebook really can’t function as a social network

Could you explain that?

Distinguishing between who is a EU citizen, or who is in the EU right now is problematic. My company is applying the law to everyone.

See https://news.ycombinator.com/item?id=16751431