I think GDPR is a good example of why it doesn't really work in practice.

I think the fines and enforcement have been a generally good balance to the status quo in the USA.

But- in practice, is your data materially used differently than in the USA?

The problem is that no one is abandoning facebook, instagram or youtube and that data is being used in the exact same way as it is in the USA- to sell you things and track you across the web. Technically there are more barriers to getting and using that data, but I would argue that it's not a blocker, just an inconvenience to those using that data- it just makes the targeting etc. 10% less accurate. The whole system still runs the exact same way.

And, to make it look like it seem like it works now everyone has to deal with these dumb popups that don't mean anything.