Neither is widespread. Leaving users, especially vulnerable ones, to the whims of businesses.
Privacy isn't a "technical matter".
Better to protect the people from all the bad companies, not just the ones who do business in the EU, right?
And no: the GDPR isn't just about GA, and it isn't just about the internet; it's about any personal information.
It's not against the law to just walk in; or rather, it's the civil offence of trespass - you can sue the trespasser for damages, e.g. causing wear on your expensive carpet (but you'd have to produce evidence of monetary damages). And you can physically remove them, perhaps with the help of a bailiff. But the police won't help with common trespass - it's not a crime.
[Edit] At least, that's how I understand the law here. IANAL.