So now to create any web page compliant with the EU, I need to hire a lawyer to help me understand the 11 chapter 99 section GDPR?
Collecting that data on a web page is a choice.
A semi-hidden security benefit of GDPR is that it makes people think twice before collecting and keeping data - you can't leak data that isn't in your database in the first place.
Now "Talking over Facebook messenger" is a complete change of subject.
It is on Facebook, not you, to operate Facebook messenger in a legal way.
Facebook has not claimed it's not technically possible.
Yeah, it does. A person in the US is not a server in the US. It's an iPhone in the US, not a server.
Does it really take that much of a leap of logic to understand that the server doesn't have to be on the same continent as the user?
There's a word for businesses that are systemically unable to comply with the law.
I don't know if Facebook is one of those, but it might be. Shutting down is always an option for that kind of company. Nothing of vale would be lost.
I bet you could find a dozen or more websites summarizing your legal obligations if you wanted to create one web page.
Since the context was Facebook, I was speaking about what businesses should do. And especially large businesses. As far as I've heard, the EU isn't chasing folks who run a small website.
But they could, which has already had a chilling effect on small businesses. Even though the intent (and current enforcement) is to punish large companies, GDPR is written in a way that puts a large compliance burden on many small companies and startups.
Doing your accounting, paying taxes, and following labor laws are also burdens on small businesses. Not every small business is profitable enough to manage those things and that's ok.