This is what I like to bring up every time people say the GDPR imposes no costs.

On the other hand, like any other regulation, it also becomes a barrier to entry for new players that have to expend engineering and compliance efforts.

That said, I'm wholly for data protection, data portability, and privacy. It's just a nuanced subject that is more complicated than it seems.