There's no excuse for larger players to not implement these rules. Many smaller players however, struggled and in some cases still struggle with this because some of the rules are rather vague (sometimes intentionally so in order to be future-proof) and hence open for interpretation.

There's the rub: While the law is clearly targeted at larger companies - to the extent some have called it Lex Facebook - it's the smaller companies and hobbyists, for whom implementing GDPR is more of a problem. I wouldn't be surprised if, in the long run, companies such as Facebook actually benefited from GDPR, at the expense of smaller competitors.