No, the risk is created by abusing customer data. If the cost was less than revenue then it’d be a toothless law.

GDPR is the size of a novel and attorneys can't even agree yet on what counts as PII. It's nowhere near a crisp law that only prohibits bad things you'd know not to do.

Yes, that's right, it's messy when you are tackling legislation to play catch up with technology. We've seen how wrong it can go with stuff like the last generation of cookie laws that were too tightly coupled to implementation details. GDPR is actually a nice step forward into resolving these huge gray areas that the web and smart phones have enabled as they become mainstream.

The status quo where corporations make vast profits peddling ever finer-grained user data unbeknownst to the consumer with no oversight is not good. A cultural shift is necessary. I'm glad to see the EU has the stones to tackle the issue because there is zero political will stateside for any political action other than driving corporate profits masked by populist appeals to xenophobia and whatever other irrelevant distractions they can cook up.