> This is true about a lot of regulations

Managing how the regulatory burden falls is a core part of lawmaking. GDPR fails in this respect.

Complain-investigate regimes (where complaints frequently trigger a regulatory interaction) are effective. They're also among the most-onerous forms of oversight. (Second to mandatory licensing and auditing.)

Add to that the power of each of the EU's twenty-eight national data regulators to interpret the rules. Result? A law that's great for Facebook and Google and terrible for almost anyone else. To wit, Facebook and Google's shares of EU advertising has risen since GDPR went into effect.

Cry me a river. I don't want every little startup compiling my information, and selling it once they fail.

My complaint isn’t with the objective of the rules. It’s with its implementation. One can be totally privacy-first, retaining zero customer data, and still incur costs and risks because of GDPR.

What risks are incurred by storing zero customer data?

Read again. That’s not the risk they’re referring to.

> To wit, Facebook and Google's shares of EU advertising has risen since GDPR went into effect.

Isn't this the expected result? Now only a small number of (relatively) trusted companies have my data, not multiple fly-by-nights who may or may not be trusted ALL trying to gather it. To me, that's a net gain - Google/Facebook would have got that data _anyway_, but I now have less companies trying to gather it _as well_.

The GP is saying that a regulation’s unintended or higher-order effects can create a net negative impact on society. Why “should” such regulations exist?

I'd like to see at least some evidence of the "net negative impact". In the case of slaughterhouses, it impedes the local and smaller-scale (and possibly more-human) commercial slaughter of animals. But slaughterhouses should probably, in general, be regulated. I'm not sure if extant regulations are net negative or positive. But I know that their complete absence would probably be bad. It's not a matter of existence, it's a matter of implementation.

I'm not sure it's net negative in the case of the GDPR. As a sibling (cousin?) poster said, good riddance. No company should be allowed to mismanage my personal data, big or small. Until I see evidence that GDPR compliance is cost prohibitive enough to suppress startup formation, I won't be convinced that the tradeoff isn't worth it.

It's VERY hard to demonstrate net negatives on second and third order effects, especially so as to convince a proponent of the first order effect. You're looking at businesses not created, features not developed, strengthening of colossal businesses (celebrated upthread), and adverse changes that aren't superficially related. The most comprehensive evidence comes from decades long comparisons of countries or differences in regulatory regimes (before and after airline and trucking deregulation in the US) and you still have epic arguments over results and effects.

The other issue is philosophical. You seem to want proof that a company should exist and require extraordinary evidence against a law. I want proof that a law should exist and require extraordinary evidence against a company. As a shorthand its France vs America. You'll note that we're not using Minitel bur rather a board hosted by a VC operation who shares a mindset with the founding team of Uber.

As Frédéric Bastiat said, there is that which is (easily) seen and that which is not (easily) seen.

Hazlitt: “The art of economics consists in looking not merely at the immediate but at the longer effects of any act or policy; it consists in tracing the consequences of that policy not merely for one group but for all groups.”