> The legal cost of dealing with a few _mistaken_ (or fake) GDPR complaints can wipe you out.
No, they can't. It's not an automated system that automagically fines companies if they get flooded by fake emails or whatever, they're pretty reasonable most of the time and you get given plenty of chances to work with regulators before they decide to fine you even a single euro (assuming you're guilty in the first place). Even if you get fined, they're usually scaled to the severity of the offense as well as the company's size.
Plus the solution is super simple, just don't invasively track your users without consent! I love that I can use the GDPR to tell my manager to fuck off when he talks about using some invasive tracking bullshit on our users, I'm glad it's there.
I'm not sure if this[0] is the most up-to-date list (I've seen a number of these lists), but take a look yourself. Most of these fines are tiny, certainly not earth shattering for any company of any size with any stability.
And if your business can't survive the financial burden of complying with GDPR, then good. There's no reason for a small business to even be violating it in the first place, since we've had about a decade of forewarning at this point regarding these privacy laws.
The legal cost of dealing with a few _mistaken_ (or fake) GDPR complaints can wipe you out.
The bigger company will have inhouse or retainered lawyers who'll deal with it.
Almost all regulation acts as a barrier which protects bigger companies who can pay lawyer fees without blinking.
It's amazing how much of the HN crowd sides with the bureaucracies which are basically pals of the guys with deep pockets.