I run a simple personal blog. I make a meager $200 a year or so from targetted ads on that blog. I have Adsense and Analytics collecting what they collect. My stats have IP's, countries, browsers, OS's, list of pages a visitor looked at, etc. I look through the info on occassion to decide which random rambling I wrote that I should improve or update on the site. This is a hobby but it has expenses and income so it's effectively a business.
At $200 a year there's no point spending even a few hours to figure out if I need to ensure GDPR compliance in the first place much less to do so. No point in figureing out how to erase users if I should ever be asked to, etc.
Last night I tried to log into AdSense and turn off targetted ads because I figure that handles most of my risk and is one of the evils people seem to be trying to kill. I couldn't find the option, only found old articles about it "coming soon" on Google, and got nowhere in a half hour or so.
Are there any limits to the sizes of companies that have to deal with this? Blocking EU might be the only real option I have (although some say that's not even enough).