> Most of these legislation are a big hurdle for startups (e.g. you have to have a "chief privacy officer" for GDPR) but at best a hiccup for big tech (no, million, even billion dollar fines are nothing but a hiccup to their uninterrupted business models).

I am a consultant. My colleagues and I work for a number of smaller and larger companies in the Nordic countries and elsewhere.

My feeling is this isn't as big a problem as HN makes it out to be.

As a small company it seems you'll get questions and free advice first, and then only you'll get fined unless the violation is intentional or so severe that you should have realized.

I guess that it is much bigger problem for the megacorportations. I guess in addition to the fines doled out so far they've also spent countless hours both at work and at night to try to get passed GDPR, and also I guess it has slowed down internal processes quite a bit just like the Sarbanes-Oxley Act (SOX) did a couple of decades ago.

I can only agree. I work for an agency (part of a big consultancy) as well as a freelancer for small businesses.

It is really easy to comply. Even if you want to use specific services for which there is no alternative.

But more often than not there are alternatives (for cookie consent, for analytics, for hosting, for CMS, for newsletters, and so on).

Marketing conversion tracking becomes more effort, though. That's true. Because that would mean handing your user's data to the big monopolies like Google or FB.