Only problem with GDPR is that while the spirit/intention of the law is great (and it even prohibits malicious compliance such as consent prompts that make it more difficult to decline than accept), enforcement is significantly lacking which means it's still more profitable to breach it than respect it.