What you and many others are missing is the fact that major part of GDPR is about collecting unnecessary data, specifically PII, personally identifiable information. If your web/app/whatever has legitimate reason why it needs the data, GDPR is fine with that. For example it's perfectly OK for a dating app to collect information about person's eye color and height or for medical app to have access to your heath-related information, even though it could be used (with other data) to identify specific individual.