Have you noticed the increasingly-complex cookie disclosure forms popping up on even the most unassuming website? These expanded forms aren’t present because digital businesses have suddenly decided informing customers about their data collection practices is an ethical imperative. Instead, these companies are most likely working with customers in both the U.S. and the EU, and they find themselves facing significant backlash if they aren’t following strict transparency rules.

These GDPR rules define potentially devastating penalties for unassuming companies, and these penalties can come for the most unexpected reasons–if you don’t know the rules.