I'm sorry but that's just FUD. GDPR fines are only for serious infractions with intent, most violators get off with a warning. Furthermore, access logs are OK because they're a legitimate purpose, as long as there's rotation.
I’ve recently tried to figure out if it’s okay to use something like Cloudflare Pages to host a blog. That’s not an esoteric question, but I was unable to get an answer. They’re not based in Europe, the log retention policy is a bit unclear, regulators seem to be disagreeing on whether even their CDN is okay (and Pages is built on top of the CDN). And in Germany, the real danger isn’t a regulator fining you, it’s a private lawyer sending you an “Abmahnung”. Which they will do for any trivial infraction, often using automated platforms.
From experience I personally would not host on CF pages. But, depending on the content and intended audience CF pages could clearly be argued under legitimate interest. You would/should probably have a TIA in place and state that in the privacy part of the site.
I know people arguing legitimate interest when using Webflow. Also clearly PD being transmitted towards a non EU country there.
As said. Personally I would go with something like uberspace.de as I just like their offering and the fact that I always have a human replying and being helpful when something breaks because I fatfingered it.
Social Login Buttons are probably a problem too, if they automatically redirect. Could be considered a transmission of IP.
Game Servers that connect to Steam on client connect are probably a problem too.
I like the idea behind GDPR but the implementation is a fucking shitshow.
At least when hosting with an European host.
One needs an imprint and data privacy page. But both is easy (except in specific cases like for MDs that need to add just a little bit of information in the imprint).
I support small businesses with their web activities. It did not get overly complicated through GDPR.
Really? I have a small personal website with no tracking; I guess my hosting provider collects server logs, but do I really need a privacy page for that?
An imprint is something I've only seen on German websites (I recall reading somewhere that those are required by law there).
At first glance, a "private" page does not directly process personal data and would therefore not require a privacy policy.
So if you don't use contact forms, advertising banners, social media plugins, etc., you should be on the safe side.
What most don't see: The server on which pages are located (hosted) collects personal data in the background in the form of server log files. These log files contain IP addresses, these addresses are personal data.
So yes. Even if the server doesn't log the IP to logfiles as it still receives the IP every site needs a privacy page.
There are good privacy page generators, though. Free of cost.
Well, I'm not in Germany... you didn't mention in your original comment that it only applies to German websites!
Everybody else. Officially if you target European audiences you would need to adhere to the same regulations, but practically nobody could reasonably enforce it.