If the user wanted privacy, they wouldn't be giving data to our services. It's a bit ridiculous to punish us for keeping what users freely give us.

It's not given freely unless consent is given, which in most cases it isn't.

You're referring to express consent. However, the user is granting implied consent - they're the ones visiting our website, they're the ones requesting our images and executing our javascript, and they're the ones filling out our forms. We're not forcing them to do any of these things.

Under the GDPR explicit conset is required, implicit consent is no longer sufficient. End of story.

As the operator of the website it becomes your duty to properly inform the user of what you are doing with their data and why.

Extreme example: you are standing in the way of my car.

Extremer example: you jumped in front of of my car.

Implied consent is not consent.

It certainly is, and any reasonable person would agree.

If you send me an email, am I allowed to keep your email address in my mail logs, archives, and inbox? Hell yeah I am, you gave me implied consent to do that by sending me email.

Am I allowed to spam the email address you gave me? Of course not. But I can keep it.

Placing an automatic and extreme burden on the recipient of a communication like a website visit or email, which is exactly what the GPDR does, is just plain bananas.

Here is your hero:

https://en.wikipedia.org/wiki/Leopold_II_of_Belgium