For the GDPR to be effective, there will need to be several more rounds of “yes, we really need you to change”. It’s a big change in business practices, and businesses don’t like change when it come to their revenue. Lots of laws get passed and then not effectively enforced, and I can’t really blame businesses for not wanting to entirely upend their business model for something the EU might not care about in a few years.