Regulatory interactions are inherently costly. It doesn’t matter if you do everything correctly. People will mis-understand and file complaints; you’ll need lawyers earlier than otherwise. This inhibits business formation. For large companies, whose data represents the greatest systemic threat, I think the trade-off is worth it. For smaller companies, having an EU lawyer on staff is not.

I have a client who is a freelance writer. She has basically ZERO technical knowledge. It was a struggle for her to get Wordpress set up. She is absolutely terrified of GDPR, to the point that she's scared to log in to her website.

To her, what does being "mindful of their user's privacy" even mean?

She probably has analytics installed. Maybe she collects some emails.

There is zero chance she is going to be abusing her user's privacy. All GDPR has done for her is cause stress -- and caused her to spend more money on basically useless "GDPR plugins" for Wordpress.

There are countless people like her, who are spending money effectively on nothing. Because of GDPR. It's horrible. In my opinion.

It makes no difference where the script is if the regulation only applied to the large companies behind them.