The GPDR makes it so small companies need to hire expensive lawyers to be compliant (and you still don't know for sure, based on the laws)
How about fining individual developers with poor coding practices?
How about fining individual developers with poor coding practices?
Also, it needs your company's business model to not be selling user data. That's why American companies find it hard to comply with.