Money is the only thing the law is about, not privacy. Even if you disagree with my opinion that it was designed to be this way, there’s not really an argument to be made against the suggestion that all it’s accomplished is periodically fining foreign service providers (plenty of fines to EU businesses too, but there has never been and will never a large one).

If it was designed to protect privacy, it is very clearly failing to achieve that objective.

I've seen plenty businesses make policy changes based on it, and you don't get to declare that somehow that isn't an argument that's allowed to be made. (And these businesses avoid getting fined and making headlines, silence in that sense isn't a sign of failure of regulation)

We only fine those companies who break the law. Most of them don't break it.

So if it isn't perfect, it isn't worth doing it at all? Is it better not to have GDPR and just let them not even get fined? I agree that fines are basically the only effect it had - but that does not mean it isn't a step into the right direction.

I agree that it could be more effective and I would welcome more effective policy in regard to data collection/processing and its transparency.