Again, large companies will have no problem implementing it. They have multi-million dollar budgets for lawyers etc. At first, most smaller companies won't turn away EU traffic, nor will they comply with GDPR. But as more companies become aware of the regulation and the extraordinary financial liability that comes with EU traffic, most outside the EU will simply turn away that traffic. It might take a few years or even a decade - but it will happen. It won't take too many horror stories about how small companies were destroyed by huge fines out of Germany, for example, to turn the blocking of EU traffic into standard operating procedure.

The issue isn't really even about any desire on the part of companies to abuse personal data. It comes down to the many ways that even companies with the best of intentions can violate this regulation.

You seem to be forgetting that small companies have small databases. Getting removed from a manually handled filling cabinet is easy. Add is from a manually managed database, even when it is backed up regularly.

It is also trivial to enforce a routine manual scrub of small amounts of private data.

The only people who might have trouble are "small" data resellers having millions of accounts of personal data. It is good they will have to comply.

Deletion is one tiny part of this terrible law. I suspect that most of the trouble will come from undisclosed third party trackers that the site may not even know is there. For example, imagine a company uses an image from an image hosting company like imgur on some of its pages, and at some point the image host decides to start sending its own cookies. That completely innocent scenario could result in millions of dollars in fines for the site under GDPR. Because of this singular issue, all forums that have ever allowed users to post images from third party sites (which most do) will likely run afoul of the GDPR, simply because they will be causing tracking cookies to load that they don’t even know about - and this is just one of hundreds of examples of issues that will put massive swaths of sites in violation and make them subject to fines by revenue-hungry EU member states.

If you did not know the breach has occurred, you're legally in the clear. Once you do know, you have some obligations. For bigger companies, you have to appoint a data protection officer who is supposed to know. (This includes big as in amounts of data too.)

If you're using a third party service, you will have to use it with prejudice. No more randomly including J. Random noncompliant Ad Agency as a middle man illegitimate handler and washing hangs of it.

Also URLs are perfectly fine as you're not processing the data. The thing that changes is that you have to specify which third party service you use and that it is externally managed. Probably link to their privacy policy and they also have to be compliant with GDPR. This will make it possible to actually get rid of the images and protect your privacy.