Comment by drnick1

But the GDPR does not achieve anything in practice. You get annoying cookie/tracking banners that you are effectively forced to accept in order to use the website, and companies keep collecting data. They promise not to misuse the data, but we all know that they still will. Enforcement is very difficult because it is impossible to audit every tech firm out there, so you are essentially relying on leaks and whistleblowers for the truth to come out. A complete ban on data collection not directly provided by the user would have been more effective overall, even though you still face the same enforcement issue.