If you're technically unable to comply with the requirements of fetching all PII for a given person and subsequently delete it, you have no business storing that PII in the first place. Your line of argument is like complaining that seatbelts are government overreach that increases the cost of cars.

Usually, complying with the law is the best solution if you do not want to get sued.

The problem is that it is often hard to interpret what the laws mean (they are made by politicians and not computer scientists), and which behaviour risks you getting sued and which not.

Complying with GDPR by not taking data you do not need is easy.

Lawyers mainly worked on producing disinformation about it because confusing people made for better consulting fees, but especially once guidance on "legitimate use" filtered out from legalese, they kinda stopped having an angle

... unless what you actually want to do is to violate GDPR and trade in PII, then you need to lawyer up

> Complying with GDPR by not taking data you do not need is easy.

If your claim was true, the solution would be easy: I simply find a need for all data that I collect.

Problem solved? For sure not, which obviously falsifies your "idea" that it is so easy.

It does not, because what falls under legitimate interest is also quite clearly described.

Is it necessary for performing the service to end user? Is it necessary to support technical or legal issues in providing the service? (Trading data with other entities, marketing, etc ARE NOT, logging, debugging, security/audit logs ARE).

Creating BS claims for "legitimate interest" like IAB does is just setting yourself for big fines for breaking the law.