Yeah this sounds more like change management issues with the tech rather than steady-state problems. Changing anything is hard, but what about after the change?

Our company didn't engage in any ad or ad networks. But the cost of compliance is the same.

I understand, my point is that nobody has really thought about this in detail, so you can't just plug in libgdrp to avoid the legwork, like you do with libjpeg or libffmpeg.