Last year, I created a 100% FOSS "startup." The idea was to "fight" Cloudflare. I developed the bot detectors myself, most of the services, and also the entire proxy engine and DNS. In MVP, I hired a former CloudFlare developer, and he helped me with the final adjustments. I pitched to some VC in America and Europe, I even managed to get two investments (one of $50,000 and another of $180,000). The money was more than enough to pay the programmer I hired and the infrastructure costs. The project was 100% open source, with the source code available for anyone to scrutinize.
The biggest problem was the legal aspect of the business. I had a horrible experience with a European firm, spending $60,000 to "legalize" the startup, and it simply didn't amount to anything. To this day, they haven't gotten back to me, and yes, I sued the firm, but these things take time. In America, I had a different problem: absolutely no law firm wanted to take my case. In meetings with lawyers, they said that legalizing this type of project is basically impossible simply because it involves working with PII and network-level telemetry. So, obviously, I played the Cloudflare card, if they could do it, then anyone should be able to too. But that's the problem. Cloudflare wasn't created by someone like me, an outsider, but by someone with strong connections to the American government. Even today, Cloudflare doesn't face any compliance issues despite the nature of their business. But anyone who wants to do the same will face a ton of legal bureaucracy that makes the business simply unviable.

I genuinely hate Cloudflare, but I hate even more the governments that allow this satanic entity to exist. I tried, I did everything I could, I spent my money and investors' money, but the fight seems completely lost. I genuinely don't know what else to do. The money I received from VCs basically ran out, and I couldn't legalize this mess. It's amazing how nobody questions the legal merit of Cloudflare.

What are the legal issues, exactly?

Keep hunting for U.S. privacy‑focused lawyers and ask everyone to chip in to the EFF and ACLU, then see if they'll help set up legal services.

Can someone break down what counts as PII and what network‑level telemetry looks like? and spell out the exact legal issues?

What does Cloudflare actually provide—bot protection, right? Don't sites have to buy it one‑by‑one? Couldn't you sell that service for site by site?

I suggest you launch a privacy‑oriented DNS and get people to start using it. It creates a service that is already running in the U.S. which makes it easier to sell.

https://en.wikipedia.org/wiki/Cloudflare

"... Project Honey Pot, a product of Unspam Technologies that partly inspired the basis of Cloudflare."

>I genuinely don't know what else to do
I've been thinking lately of this idea; Anachist Company.
where a company or a startup works completely in the dark and out of the law's reach, like a mafia but it provides normal goods, or sevices that any legal entity can do.
the idea is to simply trully allow the parallel economy start by introducing this concept that now we can have our own economy outside of the law using our tools audited or created by us, to provide all services our lifes depend on without the state's knowledge or reach, without risking our lives since the AC must be of a good OpSec practices.
I don't know if such a thing is possible but I'm thinking about it.
And just like dark markets, reputation and trust is the profits.
You could take your idea and start in niche markets, and grow from there, and when operational your servers should be hydras, synthetic links of something that cannot be taken down or controlled, you structure the service in a way that it simply creates itself when down, self-propagating servers.
as an anachist company you can steal, no one can get you (if you manage to setup a forgiving good opsec env) or file a ticket or any legal shit. you can steal ideas, products, or better make your cutting edge goods pushing into what they call blue ocean, but as an anachist company you have no legal protection, which means you too can get robbed by big tech (unless you manage to scare the top-c sissies with a sharp knife XD).
in a possible future, anachist companies can hire gangs or militia for physical security.
as for funding, if you find a like minded VC then hell yeah but if not you'll have to suffer to make costless goods until next stages are fundable.
I don't know If you can outsource the reachable components of your business like costumer services without compromise
but yeah tread lightly, and have fun.