But just because it requires changes affecting companies outside of EU that doesn't make the jurisdiction global. It's the same as with any other product that you are selling - if you want to sell it in EU, it has to satisfy EU's rules, irrespective of where it's being assembled / produced.

So if you "sell" to EU residents, follow EU's rules.

> So if you "sell" to EU residents, follow EU's rules.

Surely this will just result in the development of the reseller model?

As long as the reseller doesn't collect data, they're protected and as long as the US company doesn't maintain a presence or ideally market to the EU, they're untouchable due to the lack of any EU-US enforcement agreement for the GDPR.

Part of the length/complexity of the GDPR text is to deal with "cool hacks" like this to avoid having to spend money on IT security or to respect user preferences.

I think that's fair, but I don't think it's necessarily fair to put the responsibility on foreign websites to do the blocking and vetting. If the EU wanted to block websites that aren't compliant, that would make more sense IMO.