GDPR
general-data-protection-regulationDefinition
The EU's General Data Protection Regulation (2018): personal data may be processed only on a lawful basis, for a stated purpose, no longer than needed, with the person able to access, correct, export and erase it — and a breach reported within 72 hours
It applies by the person, not the server: an EU reader of a US site is covered. For a web property the working consequences are consent before non-essential cookies, a privacy notice that names purposes and retention, and processors — analytics, email — whose own compliance is documented. Fathom's cookieless model exists to sit outside the consent requirement entirely.
The law that made "why do you have this and how long will you keep it" a question every form has to answer. Its lasting effect on the web is less the banners than the habit of writing the retention story down.