Managing how the regulatory burden falls is a core part of lawmaking. GDPR fails in this respect.

Complain-investigate regimes (where complaints frequently trigger a regulatory interaction) are effective. They're also among the most-onerous forms of oversight. (Second to mandatory licensing and auditing.)

Add to that the power of each of the EU's twenty-eight national data regulators to interpret the rules. Result? A law that's great for Facebook and Google and terrible for almost anyone else. To wit, Facebook and Google's shares of EU advertising has risen since GDPR went into effect.