> obviously Isn't it a significant expense to comply with the GDPR, especially in Facebook's business? I'm guessing the only companies doing this don't have much to lose by complying globally.

There's three costs:

1. The administrative/maintenance cost of complying: this is sunk if you have European users at all.

2. The cost of the measures to your business model, if personal user data is a central part of your business model.

3. The adminstrative cost of maintaining radically different user data management systems for EU -vs- non-EU users.

Doing number 3 is only worthwhile if it's a lower cost than number 2. I would guess 3 would be higher than 2 for most companies. Clearly, 2 is extremely high for Facebook.

I can imagine that there is a local minimum of costs 2 & 3 where the infrastructure is modelled so that privacy legislation is supported, but the company makes no commitment to enforcement/compliance anywhere but the relevant jurisdiction. That way you've take the sunk costs of development (technical and compliance), but drained the project of any administrative costs for the rest of the world...

If you do business in the EU, you'll incur most of those expenses anyways. It makes sense that companies would offer privacy protection to all their paying customers.

In the case of Facebook, it makes sense that they wouldn't want to offer privacy protection to their livestock.

I mean cloud providers are different. First, there's that level of indirection. You're a customer, not necessarily falling under the GDPR, but your customers might. So the mechanisms are in place to handle that worldwide, which you could choose to extend to everybody. Then there's the data from you being a customer directly, which is largely exempt from many GDPR things like opt-in anyway, since they actually need it to e.g. bill you, provide customer support, etc.

So far, I don't think any cloud providers show you ads based on your usage, but it's only a matter of time :) / :(