GDPR is just fine, if you've got your shit together and has some actual benefits for users, like being able to request all my saved data and its deletion. And of course disallowing websites handing my data to every possible ad network without my consent.