GDPR changed a lot. From my own experience, European companies think much harder about what data to collect, where to store it and how to distribute it. We're not even close to 100% enforcement, but a huge step forward from where we were.

If this law only reaches 20% of what it envisions, it'll do more for consumers than other laws before.