It only seems complex because everyone has been implementing user-hostile datamining operations for years before GDPR was enacted. So for every external service you use, you must make sure that they implemented GDPR compliance or not. If GDPR had been a law since the beginning, it would be much simpler.
Although I'd like to know, what difficulties have you been facing in your startup, exactly?
Although I'd like to know, what difficulties have you been facing in your startup, exactly?