Reading http://techblog.bozho.net/gdpr-practical-guide-developers/

>Don’t assume 3rd parties are compliant – you are responsible if there’s a data breach in one of the 3rd parties (e.g. “processors”) to which you send personal data.

hmm how do we federate now?

@clacke @aemon Regarding socnets, there's this peculiar one that I've taken interest in, https://github.com/Rotonde/ Through its use of Dat it does away with the notion of the instance itself, every user is just a file on a distributed network
The huge downside is how you cannot interact with people you don't know, because it's closer to peer-to-peer RSS than to Mastodon.