Oh boy you have no idea how horrible it is. Check out the latest rulings in that regard. Google Fonts is a big no now. Everything that "transmits PII (including your IP address)" is problematic. Its just a matter of time until all those free static site hosters (github/gitlab pages, netlify, etc) are targeted, cloudflare probably too. Our legal council already told us to "at least add some notification that people are leaving the site" if they click on the social login buttons ... because it could be considered transmission of the IP because of the redirect.

Ain't it Google specific?

Yes, I’m specifically in fear, uncertainty and doubt. To be clear, I’m fully onboard with the intent of the GDPR, but I have no idea how to follow it. And “you’ll be okay, the fines are probably small” is exactly the kind if statement that causes anxiety.

I’ve recently tried to figure out if it’s okay to use something like Cloudflare Pages to host a blog. That’s not an esoteric question, but I was unable to get an answer. They’re not based in Europe, the log retention policy is a bit unclear, regulators seem to be disagreeing on whether even their CDN is okay (and Pages is built on top of the CDN). And in Germany, the real danger isn’t a regulator fining you, it’s a private lawyer sending you an “Abmahnung”. Which they will do for any trivial infraction, often using automated platforms.

Are you located in Germany? If so - welcome to the boat.

From experience I personally would not host on CF pages. But, depending on the content and intended audience CF pages could clearly be argued under legitimate interest. You would/should probably have a TIA in place and state that in the privacy part of the site.

I know people arguing legitimate interest when using Webflow. Also clearly PD being transmitted towards a non EU country there.

As said. Personally I would go with something like uberspace.de as I just like their offering and the fact that I always have a human replying and being helpful when something breaks because I fatfingered it.

Yeah, Cloudflare Pages is out, same as Github/Gitlab Pages, Netlify and all the other free offerings Hosted by a US Company.

Social Login Buttons are probably a problem too, if they automatically redirect. Could be considered a transmission of IP.

Game Servers that connect to Steam on client connect are probably a problem too.

I like the idea behind GDPR but the implementation is a fucking shitshow.

Agreed. To add to that I would say that publishing a website (if you yourself don't do tracking, advertising, affiliate and all that) is in no way impacted. A simple web site without cookies and not transferring user data elsewhere but the hosting webserver is not impacted at all.

At least when hosting with an European host.

One needs an imprint and data privacy page. But both is easy (except in specific cases like for MDs that need to add just a little bit of information in the imprint).

I support small businesses with their web activities. It did not get overly complicated through GDPR.

> One needs an imprint and data privacy page.

Really? I have a small personal website with no tracking; I guess my hosting provider collects server logs, but do I really need a privacy page for that?

An imprint is something I've only seen on German websites (I recall reading somewhere that those are required by law there).

In Germany every site that collects, stores and/or processes personal data (PD) is required to have a data privacy explanation that is easily reachable from every page and explains to the user what data is being received, stored, processed and also explain the user's rights (for example the right to be informed, to correct data and so on).

At first glance, a "private" page does not directly process personal data and would therefore not require a privacy policy.

So if you don't use contact forms, advertising banners, social media plugins, etc., you should be on the safe side.

What most don't see: The server on which pages are located (hosted) collects personal data in the background in the form of server log files. These log files contain IP addresses, these addresses are personal data.

So yes. Even if the server doesn't log the IP to logfiles as it still receives the IP every site needs a privacy page.

There are good privacy page generators, though. Free of cost.

What if I run something like a good old phpbb just as a hobby. What would I put on that privacy page? You enter your email address on sign-up. It's visible in your profile. You get notifications to it if you subscribe to topics. Isn't it kinda obvious it is stored? What if phpbb logs IP addresses for every post? I know it did in the past and don't remember there being an option to have that purged after a given amount of time. Can I do that? Do I need to put an imprint on the page, or is a contact form enough? Maybe I don't wanna put my name and address openly on the web. So I guess I'm just way to afraid to host a forum in Germany for my local sports club, because I don't wanna get hassled by lawyers who made this their business model. Better open a Facebook group, this is certainly much more privacy friendly.

> In Germany

Well, I'm not in Germany... you didn't mention in your original comment that it only applies to German websites!

Germany is the only country I can speak of from experience. Not sure about the other EU countries, but would expect similar regulations.

Everybody else. Officially if you target European audiences you would need to adhere to the same regulations, but practically nobody could reasonably enforce it.

Well, as I mentioned, I've only ever seen an imprint on websites from Germany, so I think you're conflating EU and national regulations.