My experience is that GDPR added a lot of compliance activity at companies but did not materially improve actual privacy. Companies pretty much do what they did before GDPR, just with a layer of bureaucratic indirection in between now. I'm pretty sure that wasn't the intent but that's where we are, and in that sense it was a failure.