6. of minimization

We’ll just block the EU and California from our site. We’ve got enough customers elsewhere.

Threat
	Although you’re using avoidance as a way of reducing risk, blocking based on geographic location associated with an IP isn’t an effective measure because it can be circumvented. The regulations also take into account whether European customers are targeted by advertising even if their IP is blocked. The CCPA talks about residency status and not your physical location. If you are handling an EU citizen’s or Californian resident’s data, you need to respect their rights irrespective of where they are physically. Also, more and more nations or states are now implementing similar regulations.
GDPR	Chapter 1, Art. 3 – 1 Chapter 1, Art. 3 – 2 Chapter...