> Bullshit. It's trivial to implement. Don't store my personal data. Done.
Tell that to the dozens of engineers that spent months on GDPR compliance at my company.
I personally spent two weeks making sure my systems had both export and deletion capability. These systems were engineered for soft delete data retention and maintaining change logs across writes. In several different databases. And offline data warehouses. And feeds consumed by downstream systems.
> But the blanket statement "GDPR compliance can be extremely expensive to implement" is on its own extremely misleading in this context.
You have no idea what you're talking about. Every system out there handling personal information needs to be re-engineered. Soft deletes, change logs, feeds, plumbing between microservices, data validation logic, primary keys and foreign keys with PII, on and on... it all needs to be changed to handle new APIs: delete and export. That requires a lot of work to do correctly and capture all of the surface area.
> Perhaps, but this is not relevant to a news organisation publishing a general article online from the USA
Maybe they can't afford to change things? Sure, they might be collecting too much information in order to sell ads, but they have to decide if the EU traffic is worth rebuilding what they already have in place.
Don't take a gut value judgement about GDPR being the right thing to do and equate it to being inexpensive. It is not.