While this is true, and generally true for all regulations (they tend to help the existing players as it creates a moat for new entrants), GDPR entrenches FB/Google further because a lot of the law focuses on sharing data with third parties. Google and FB already have their scripts and tracking tags loaded on a plurality of sites you visit, but since they're only sharing it with themselves, it does not impact them as much as it impacts smaller players who would have to rely on data brokers and third parties to approach similar coverage and data.