It could also be the reverse (see authoritarian countries), with international players leaving the market and local ones filling the space.
I just don't see that happening here. So maybe the UK becomes a no-travel zone for anyone in the worldwide tech industry? That would be sad, but it's a plausible outcome.
The UK's law is obviously a bit different as international companies can comply with them, but it would essentially just limit legal websites to big tech who have enough market reach that all that compliance could pay for itself.
We would have real privacy protection, and presumably in the very long term we'd see the benefits of that (more creative new ideas coming out of the EU, wealthy people preferring to live in the EU...).
Wealthy people care a lot more about taxes than vague notions of privacy protection.
It's worth noting that it's the US that would be isolated here, not the EU.
A very large number of other non-EU countries have implemented/are currently implementing extremely similar legislation to the GDPR, including Brazil, Israel, South Korea, Argentina, Canada, Japan, India, New Zealand, Indonesia, etc.
If the world eventually splits into "privacy-required" vs "privacy-optional" internets, the US will be one of few major countries in the latter camp. Yes, clearly the US-based internet is a large chunk, but long-term isolating the US internet entirely from most of the rest of the world will have a meaningful impact.
The EU has an list of countries whose current protections they officially recognize as already equivalent to the GDPR here: https://ec.europa.eu/info/law/law-topic/data-protection/inte...
* https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/
* https://www.cnil.fr/en/use-google-analytics-and-data-transfe...
* https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/d...
So far they've just been enforced against companies that use Google Analytics, but the reasoning behind it has been that having users connect to a US server enables that server to know EU users' IP addresses (which are legally PII), which would be subject to US government subpoenas to collect such, and the US government has not agreed to handle data in compliance with the GDPR, therefore it's illegal to have users connect to any US servers. It has nothing to do with "hoover[ing] and hoard[ing]" data.
The only way for an American website to comply would be to form a separate company not subject to US control at all. However, at that point it's not really an American website, since no data or control can go to the US.
Theoretically you could use some international service to handle all primary routing and get users to waive their rights under the GDPR before connecting to your website proper, but I'm not aware of such a service at this time.
Or those sites would have to comply with GDPR. Why is that not an option?
