you are not wrong about that. it’s just the reality we live in means that to implement gdpr as it is now you’d have to kill the entire data driven ecosystem and start from scratch… and nobody will do it unless everyone else is doing it. the result is that we have well meant but ultimately unenforced legislation that causes everyone to stretch it just a little bit.