It’s not about being able to “mess with [your] users”. It’s about sites that don’t need EU traffic anyway being unnecessarily exposed to fines for even accidental violations of a very complex law.

Btw. same goes the other way around: if you don’t want or need US customers, it might make sense to block people from the US based on IPs, because if you do business with US citizens, they can sue you according to US laws with their ridiculous high fines.

But any of your sites should protect user data, it's the respectful thing to do. Right ?

In which case would you you think it's alright for any site to not protect, say, a user home address ?

Reasonably protecting user data and complying with the GDPR are two entirely different things. There are many ways to accidentally run afoul of this law while still protecting user data.

Define "reasonably", because what I see in the wild as a freelancer is 9 times out of 10 not matching what's "reasonable" to my standards.

And what are the "many ways" you can "accidentally run afoul of this law while still protecting user data" ?

It's hard for me to grasp.

(I'm not the one you replied to.)

I'd like to see a complete and concise list of exactly what needs to be done to comply with GDPR. Everything I've seen so far has been vague legalese open to subjective interpretation. Pretty scary when the punishment for an incorrect interpretation is a 20M EUR fine.