[Andre]

I've been trying to look into this whole bureaucratic legalistic EU nonsense too, and while the ideals behind the GDPR are highly laudable it's going to be close to impossible (especially for legacy systems which are no longer in development) for a lot of the web to become complaint.

On my own portorleans.org site for example I use the phpBB forum software, partly as a low-traffic bulletin board system for very infrequent questions (most people seem to use Facebook these days) and partly to push my own content onto other pages in a blog-like manner (such as News posts, etc.) However phpBB does not encrypt its SQL fields such as username, email and IP address (although it does hash passwords) so technically I guess the whole thing is non-compliant until such time as it does - whenever (if ever) that might be.

I've decided that from 25th May I'm going to have to block all access to my site from EU countries unless the user explicit consents to continue based on the site's Privacy Policy (which I've tried to write in plain English, which is something that the GDPR encourages and I fully support), but I've no idea if that will be enough.

Andre