95% is not acting ethically it’s documenting how you are in compliance in a way that will hold up to whatever regulating agency comes asking.

Doing that requires understanding a law with out much case precedent, that is extremely broad and has a whole spectrum of enforcement options.

I completely see why a small org might decide to just geo block. That’s an easy to implement, easy to document & defend attempt at compliance.

1. It seems to me that a common question many would like answered is: whats the simplest way that I can serve http requests without incurring the wrath of the GDPR?

2. It was my understanding that GDPR compliance is extremely expensive, is this not the case? Perhaps it is very simple.

2. Depends on what your business is. A company heavily reliant on profiled advertising will have much higher costs than the typical small business with minimal (or no) advertising.

The small business (perhaps with a mailing list and a database of previous customers and invoices) should have been compliant with the earlier laws (Data Protection etc), and the changes required for them are often minor.