FWIW, I just wrote a privacy policy and terms of service for my app. I’m not a lawyer and I don’t understand GDPR. I could probably understand it if I took the time to do some research. But, at this point, I don’t have a single user and I don’t think going after the EU as an early adopter (and the time spent to make sure I’m actually compliant with their laws) is a better use of my time than targeting people in a jurisdiction I understand and can be reasonably sure I’m following the laws of.
So, instead of figuring out all of the laws of all the countries, my ToS require you to attest that you’re in the United States and using the service under U.S. law. If you try to access my product from the EU, you’re in breach of our contract. If you believe I’m mishandling your data under another countries law, send me your account and I’ll gladly disable it.
I suspect this is going to become increasingly common as companies try to regulate digital imports/exports. I’m not interested in assuming legal liability for sending bits across a border.
So, instead of figuring out all of the laws of all the countries, my ToS require you to attest that you’re in the United States and using the service under U.S. law. If you try to access my product from the EU, you’re in breach of our contract. If you believe I’m mishandling your data under another countries law, send me your account and I’ll gladly disable it.
I suspect this is going to become increasingly common as companies try to regulate digital imports/exports. I’m not interested in assuming legal liability for sending bits across a border.