GDPR is terribly vague and creates a barrier-to-entry. Draconian measures may hurt large companies, but they threaten smaller ones.
EU is saying they don't like Silicon Valley behemoths' power but they want valley-like companies in the EU (sometimes even calling for a 'European Google', as if you could just pass a rule to make that happen). And then they create laws that make it easy for the large players and harder for their competition.
Everyone here spent a great deal of money for some compliance boo-hoo. FAANG has your consent and upgrades their policy, done.
To me, this seems like ineffective and incompetent lawmaking, no matter if the intentions were sound.