I think the problem is not necessarily the loss in revenue due to "not harvesting data" but rather the cost of all the compliance measures and new processes the GDPR requires.