They won't. The ICO in the UK has already said they aren't interested in imposing fines [0]. They would much rather nudge companies into compliance.

> "The fine is really a last resort," she told Computing. "Even to get to the fine we have to go through a lengthy investigation that might take several months, then we have to take it though the courts. So fines are not our go-to tool."

However. I think with egregious cases like selling data. I am happy that the ICO fined a company for doing that. [1].

[0]: https://www.computing.co.uk/ctg/news/3027593/ico-theres-so-m...

[1]: https://www.theregister.co.uk/2018/08/09/ico_fines_data_brok...

It’s totally OK that fines are used as a last resort. As long as they will be used as a last resort.

Don't we have a glimpse of (lack of) enforcement based on previous incarnations of laws like this? What about this time is special? And why are laws crafted without ample enforcement mechanisms? At the least that makes them toothless, at the most it gives a piece of legislation that can be pulled out and used only when someone wants a reason to punish a company.

The difference is that GDPR does have effective enforcement mechanisms, precisely unlike previous laws. Now let’s see if they’ll be applied.

Mechanisms in the laws or the institutions? The difference is very important and many people, who agree with the intent of the law, have been pointing out this difference for a while now. Scribbles don't make something so. If the approach of just writing it down didn't work before, why just change words instead of approaches?

Both, if I understood what you mean: The GDPR regulation ((EU) 2016/679) contains provisions for legal enforcement, and describes which process and agencies are responsible for that.

Whether this actually works, only time can tell. But the fact that similar previous legislations went unenforced was a specific concern that the designers of the GDPR intended to address.

I honestly don't get why so many sites are even paying attention to GDPR. If they don't have a presence in the EU, it is irrelevant.

> If they don't have a presence in the EU

Only sites with a presence in the EU are paying attention. The LA Times is a counter-example of a site that hasn't bothered with GDPR because they didn't feel EU users were worthwhile keeping.

However, collecting data on the 0.5 billion people in the EU evidently seemed worthwhile for most sites.

It seems strange to me that the LA Times would cut off European users, when they presumably have to comply with the new California Consumer Privacy Act, which is similar, anyway.

Because GDPR includes provisions for handling US GDPR violators, a lot of security vendors were touting up the idea that if a European fills out a form on your site or gets cookied for any reason, you could be sued.

So they'd file suit in the EU and... what would happen? Some sort of judgment that would prevent a company from starting business in the EU at a later date?

I don't know. Why are EU companies paying attention to American laws, again?

Largest economy and military in the world are big reasons to play nice with America

The US is not the largest economy. Whatever gave you that idea?

Except for military force and incarcerations per capita, the US is lagging behind in almost every statistic compared to China or the EU.

Military doesn't come in to this at all.

And similar arguments could be made for why American companies would play nice to the EU.

If I were a company I would target America first and Asia second. Due to increasing regulations, political uncertainty and lack of growth I'd shift the EU to third (it used to be an obvious second to me).

Fair enough, but you'd be missing out on a huge market. And unlike Asia, it has a single regulation to follow for things like data protection.

If your company was unable to comply with GDPR, many wouldn't want business with your company anyway, especially other companies who are trying to comply with it.

Detained during their connection in Frankfurt?

Honestly that is a classic "Come at me bro" type of moment. Sue me in the EU, it really doesnt matter if I don't do business there.

It is not. If their customers are in the EU they have to to comply.

I was specific. If I don't do business in the EU, it doesn't matter. I don't really care where my customers are but if they pay in the US, GDPR is not relevant to me.

I get that everyone is super excited about GDPR, but sorry to say most websites can safely ignore it.

What authority would make them comply?