They provide an illusion of protection, but I haven’t really seen concrete cases where the regulation has benefited broad swaths of people.
GDPR definitely makes it harder for new companies and startups to sell to larger companies (GDPR creates a lot of paperwork required to sell to large companies, which results in lawyer fees and efforts to comply that are largely superficial)
Meanwhile, Google/Facebook/etc are finding loopholes and ways to work around the regulation to “comply” (more of less) without meaningfully improving user privacy, IMO.
I’m 100% supportive of privacy advocates, but I have a sinking feeling regulation in place today is more of a charade that makes people feel good, rather than something that is actually improving online privacy in any meaningful way.
I personally don’t mind more regulation because our company can afford to comply with anything thrown at us (and we already treat and protect user data with extreme care), but I don’t think more regulation is guaranteed to have meaningful impact in practice.
Many people already know this, but things like SOC 2, ISO 27001, CCPA, GDPR, and lots of other security + privacy compliance frameworks are largely just a matter of getting your paperwork and internal procedures in order. I’ve run into a lot of people who think SOC 2 (for example) means we’ll have to secure our servers better, but the reality is auditors aren’t looking at your servers, they look at your paperwork. Paperwork typically does very little to actually make data more secure.