So the website has to block users that don't explicitly agree, a simple statement won't do.
There are exceptions, GDPR having the notion of "legitimate interest", which many services will try to abuse, however it has a precise definition and user tracking, ads targeting, marketing, or other interests like that that don't cut it, even if by not doing so results in less revenue for the service.
The GDPR has teeth, which is why companies that have been violating user privacy are freaking out ;-)
We don't know how GDPR works. Its structure grants immense discretion to political bodies. Given the EU is undergoing another cycle of political weakness, it would not be safe to assume anything about interpretation or enforcement.
This is a good principle for Constitutional law. It's a bad principle for general law, as it introduces political uncertainty and authoritarian risks into everything.
For example, the legitimate interest. Who determines that? The authoritaa. But then the authoritaa might approve Google and disapproves small-naughty-trackor. Both are doing the same privacy invasion. So why one gets a free pass and another is reprimanded.
Even if the current regulator (persons) are honest, they are not irreplaceable. Maybe the guy after them will be corrupt. And since there is a lot of money here, money corrupts.
IANAL but implied consent, by visiting the site, is not enough anymore. Consent must be explicit and informed, afaik there are a few exceptions there for stuff that's "vital to the sites function".
* If your company is EU-based, you must comply with GDPR, whatever the location of your users/clients
* If your users/clients are EU-based, idem
* If your users/clients are EU citizens located abroad, it applies *only* if you target EU as a market. If you operate a website dedicated to sell t-shirts to Californian people, and an EU citizen living in California buys from your website, you aren’t expected to comply with GDPR.For example, when you are a EU citizen using a US social network that operates world wide (and thus also targets EU markets), you are still covered when in the US.
"""
1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. [i.e. EU companies, or EU subsidiaries of foreign companies, have to obey GDPR with all data they deal with]
2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: [foreign companies dealing with the data of people physically inside the territory of the EU have to follow the GDPR if...]
(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union [they're offering services to those people]; or
(b) the monitoring of their behaviour as far as their behaviour takes place within the Union. [they're tracking what those people do in the EU - but tracking what they do abroad doesn't trigger GDPR!]
3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law. [it applies to businesses in places with weird legal status, like some overseas possessions, or maybe the Channel Islands]
"""