We’ve spent tons of money & interacted with lots of official sources trying to get opinions about what GDPR means and it just isn’t available.
Everything is a risk mitigation technique right now with no real answers in sight. If I had any personal projects serving traffic in the EU right now that weren’t profitable I’d likely shut them down.
I think it’s likely that the regulatory agencies will act with restraint and this will all be hysteria without merit, but I’ve seen enough legal opinions to know that’s not the worst case scenario.