Yes, the GDPR is an excellent example of there being too little regulation in an area, allowing ad companies to hoover up every bit of personal information without consequence. The GDPR should have been enacted long ago.