a.) You start a business in California and plan to do business that involves EU customers. If you plan on making actaul money you'll hire a lawyer for a reasonably small number of hours to incorporate, ensure you have trademarks covered, get your EULA in order, vet your corporate structure, etc. GDPR is just another thing to add to the hopper--it probably adds an hour or two to the whole process since legal procedures are pretty template driven. Most of the cost will be the lawyer briefing you on what to look out for. (Based on my admittedly quick reading of GDPR summaries.)

b.) There's already a net decreasing trend in startups in the US, but it predates the GDPR by many years. [0] If you are looking for culprits in the legal system you are far more likely to find them in US laws (or lack of them) than anything from Europe.

Taking the EU perspective, well, I've run a small tech business in France and GDPR seems like noise level compared to the other regulations you need to deal with there. (Hiring and firing being the biggest but there are others.)

[0] https://www.nytimes.com/2017/09/20/business/economy/startup-...

Edit: add source

Nobody cares.

Name one way your life was ever negatively impacted, in a concrete way and not just in your head, by companies using your data to create value in the form of targeted ads and such to keep websites free. I'm waiting.

Facebook famously did an emotion manipulation experiment on 500k randomly selected users.

There's a trial now alleging that Facebook used profile data to discriminate against older programmers in job postings: https://news.ycombinator.com/item?id=17178565

Many types of abuses are subtle and remain unknown for the victims.

Burden of proof lies on the one making the claim.

>Facebook famously did an emotion manipulation experiment on 500k randomly selected users.

I don't really find that abusive or ethically troubling.

>There's a trial now alleging that Facebook used profile data to discriminate against older programmers in job postings:

Maybe this age discrimination, which was already illegal on its own, wouldn't have been possible to commit if the data didn't exist in the first place. That doesn't mean it's the tool's fault or that the tool should be illegal.

I didn’t make a claim, you did, then flipped it around and made one for me. ;)

We can go back and forth about the best way to deal with this, but it's crazy to think that this systemic gobbling up of personal data doesn't have real consequences.

But I can't think of any internet regulation that's ever harmed me. Which ones are you talking about?

Edit: I can think of a small number of regulations (much less than one per year) that cause problems, but they still don't meet the personal concrete harm threshold you've proposed.

Yeah, I'm onboard (like I said, I think the intent of the law is good) -- but regulatory compliance is expensive and in general creating a SaaS business is not. Compliance is more than just doing the right thing, BTW, it's creating processes, audits, attorneys, etc to prove that you're doing the right thing. One of SFDC's risks is that today a competitor could probably arrive and eat up their business by emulating their business model and undercutting their costs. They're very well placed to establish or enhance their existing regulatory compliance team(s).

This tends to not be maximally congruent with reality.