I'm going to be honest: I have no clue about social. I operate in socio-medical domain, we don't share by default.

We are mostly fine with the spirit of the GDPR, it's the work we have to do to follow it to the letter which is a problem (and the lack of process internally).