Aside from this, I just spent 10 minutes removing consent for advertising/cookies/tracking/whatever for about 100 different vendors. I really hope I don't need to do that again, ever.
Usually IP address. For other things it would have to have your permission (and if you give a Lemmy app permission for your location, well it's on you). You could probably use an EU VPN. Though I'm not sure of their implementation, they might disregard your choices if you disconnect from VPN.
Hey, thinking about this, I wonder how these rules will work for a citizen of a country enforcing GDPR, who is on vacation to a country that doesn't enforce GDPR.
Well, if you're wondering of how it should be according to GDPR, you should still have the same protections - they are for citizens of EU anywhere in the world and for all people who are currently in the EU, regardless of citizenship. In practice I'd say those that take it seriously will have a cookie on you (if you've already visited) that flags you as being from EU. Those who try to fuck with GDPR will pretend they don't know you're from EU.
I was prompted to consent to some stuff, which I unchecked. Then there was a "vendor preferences" button, where they were basically saying "ok, even if you don't consent, maybe you still wanna give them access if they have a legitimate interest". So since I have also a legitimate interest in not giving my data to shady fucking companies, I spent the next 10 minutes removing ticks from boxes basically, because fuck giving me a choice to "uncheck all", that would make it too easy to opt out.
Edit: and then to make it even more fun, I found a button somewhere in settings where I could remove my consent for gdpr-related reasons. So I clicked it. You wanna guess what it did? If you're guessing it removed my consent, sorry - it actually removed my "lack of consent" - that is to say, it reset the settings and prompted me to uncheck everything again. Cool beans.