GDPR for us Europeans was one of the best things related to privacy and internet that "went in production" from the EU Parliament. It's harsh but companies just can't profit by selling tons of their users' data or just neglect the data they gathered (see Equifax, Marriott, British Airways or other corps that put profit above anything else).
I do hope that GDPR and CCPA will just do the opposite of what we see happening in the mighty RPC where there's no privacy and mass surveillance easily leads to abuses and human rights breaches.