[galangalalgol]

Wow, that is pretty blatent. When EU stomps on them I'm sure someone else will pop up. Any chance the companies employing trustarc could be liable?

[lmkg]

The way GDPR works, I think the companies using TrustArc are more likely to be held liable than TrustArc itself. Unless TrustArc makes the unforced error of getting itself classified as a Data Controller.

[josefx]

> Unless TrustArc makes the unforced error of getting itself classified as a Data Controller.

Knowing how some scams and tax evasion schemes work I wouldn't be surprised if they could just set up a separate company that ends up with all the liability without any of the assets and just have that declare bankruptcy the moment the first fines hit. Rinse/Repeat as often as necessary.

[emayljames]

I'd say they could if wasn't the EU parliament, but that would be a very bad move as the EU parliament would hit them harder if they tried that.