Well the big difference is that even without laws against rape and murder it is generally still a big exception. On the other hand tracking, carelessness with personal data, privacy violations etc. have been very much the norm with all companies (and arguably still are) even before the GDPR.