New EU GDPR is enforced pretty soon
 

Well, if a european member want his personnal data deleted we can already delete his account, so it's okay for me :)
Cookie policy is already ok with GPRD.

But it think it's about transparency. You should write it down in your legal information what's covered. To take the wind out of the crappy lawers sails. Some sites are already closed, because they don't want all this new EU law shit. Sad but true.

No the transparency bit is that anyone should be able to get a listing of the personal information that is stored about them. EAB already has that - your user CP.

I don't think that's the way it works. And guests on EAB can't use the CP. Only one example: You should exclude any responsibility regarding data security if a user click on links that leads to other sites. Only one point that belongs in a privacy policy.

Anyway. RCK probably knows what he is doing. Don't know the French law efforts to fit the EU wide regulations. Some countries loosens them probably when it comes to financial penalties for misdemeanour. :)

edit: There is a useful privacy policies online generator (free for non-commerical use).

https://privacypolicies.com/