> There generally seems to be a lot of confusion, even in legal circles, about what ePD requires informed consent for.

That seems to be true, going by this comment section and the other ones I've seen.

It's hard to get a non-hyperbolic answer to the question: if everyone is so confused, what's the real-world consequence of best-effort implementation?

Some would say it's the ultimate responsibility of the app owner to understand the law, but how much further can you go than hiring a lawyer?

If more diligence needed to be done than that none of us would get anything built, we'd all just be running around researching the laws around these dumb popups.

What are the real-world consequences of making a mistake here? What kind of boundary would you have to trip over to actually get the authorities to prosecute you for not having a consent popup or doing it badly?