There isn't really that much overhead, especially if you keep the GDPR in mind from the beginning. The big costs happen at older and larger companies that had very lax procedures before.

I bet it will not inhibit startups in the EU.

To some part I think the GDPR is intended to make it easier for startups in Europe to compete with US services on the EU market.

In recent times, being a privacy-aware service is a selling point and the EU services can easily advertise as being privacy-first to US citizens while US companies will have trouble doing so (considering SESTA/FOSTA and CLOUD act)

Do we want startups to have a "data-backed business model"?

Yeah we do. While I don't like Google tracking where I am from my cell phone when location-sharing is off, I love listening to music on Pandora and Spotify and I would never discover the new songs I do if there was no option to like or ban songs and evolve the station.

I don't see how either of those are "data-backed business models". Pandora/Spotify have a very clear draw for people which exists regardless of how much data they store on people. They absolutely can and do use data to _enhance_ their core offering, but if they stopped overnight it would not cripple their business immediately.

Both aslo offer a very clear service, (streaming music) and both only really collect data to improve your music experience.

Facebook seems to grab whatever it can, just to make money.