We were not better off 15 years ago. We were just blissfully unaware of the problem of large-scale PII collection that was already metastasizing in the shadows.

Imagine a kind of decision square. Rows are "consciously" and "unconsciously", Columns are PII collection, and privacy (no PII collection) .

This gives us a list of 4 possible scenarios (from least to most desirable). 1. unconscious privacy, 2. unconscious PII collection , 3. conscious PII collection, 4. conscious privacy

In detail (least to most desirable situation)

Box 1: Early internet everyone had unconscious privacy. No one was collecting PII, and no one was aware of it.

Box 2: Early 21st century, people started collecting PII at an ever increasing (and frankly alarming) rate. You may have encountered tall tales where people got sent baby advertisements before they themselves even knew they were pregnant.

Box 3: The goal of the GDPR, shine a light on the situation and make everyone conscious that there is a problem; and unveil the extent.

Box 4 (future): fix the underlying problem.

GDPR already addresses box 4 a little bit. Just by shining a light on these practices, some of the slightly shady bits at the edges are already solved.

Now that the situation is visible and known, we can take further political steps at mitigation.

> Early 21st century, people started collecting PII at an ever increasing (and frankly alarming) rate. You may have encountered tall tales where people got sent baby advertisements before they themselves even knew they were pregnant.

What's disheartening is that in physical stores, this already started happening in the '90s, mainly for analysis of loyalty programs' data.