I think that any startup that allows EU traffic to access its services is going to be a tough sell to investors in a GDPR world. Who wants to put, say $1 million, into a startup that could easily be fined that amount or more for inadvertent violations? There's a whole other world of markets out there and only one that imposes this risk on companies. GDPR just introduces too much risk, even for those companies with the best of intentions.