But if you are a small company in Europe that for example is producing a better and lighter cardboard box, you will have to hire a data privace specialist because you may get sued by some random idiot if you accidentially link to Google Fonts as a convenient way to display fonts, this certainly binds a lot of valuable mindshare and resources and therefore is bad for innovation. You cannot believe how much startups here have to think about GDPR even if they do not collect any data at all. Read the other answers in this thread. There are others who say that linking to Google Fonts is equal to selling your customers' data to Google. What a joke!
Of course startups here - and everywhere else! - have to think about applicable law. Just like if you want to start a transportation company you'll have to think about applicable law. If a company does not collect any data at all then the GDPR is a complete no-brainer.
Try this and see if you can make it work for you: to identify an individual you need ~33 bits. An IP address, even though it doesn't quite get you there gives you a very large fraction of the number of bits required. Adding a few more makes the individual identified. So therefore it is a very good idea not to allow access to the IP address to unrelated parties from a privacy point of view.
<quote> If you don't understand why including third party resources for developer convenience is a bad idea then you probably shouldn't be building commercial websites.
Ironically, even in the USA with the CCPA they are trying to regulate this somehow. This is just not something you can leave untouched. Without even mentioning other non-EU countries (China/Russia/India, etc.) that have even stricter data regulations.
> Making things illegal, even if in almost all cases the use is benign or even makes a lot of sense.
What is there benign about sending your IP address to 10-15 external services that have nothing to do with providing you the service in the first place? Try to install the NoScript extension and you'll see that 90% of the websites only require the main domain to be unblocked to be used. A few more websites require allowing 1-2 additional more scripts (CDN or ... payment systems/redirects, etc..). The rest is just your data being treated like toilet paper for marketing purposes. And I wouldn't even mind if they stopped there (marketing website A buys the data, and they target you with some crappy ads you won't even click on): no, they sell, and the buyer resells, etc.
Is this really what makes a country innovative? Advertisements? I thought that innovation was self-driving cars, electro cars, new ways to fight diseases, digitalizing bureaucracy (which can be done without giving away your personal data to random online companies), etc.