Two view points to this:
1) If make to specific, big players will find a way to slip through the exceptions and game/lawyer the system
2) So vague , that only the "big players" will have the infrastructure/legal approval to actually guarantee 100% compliance. Smaller fish that the reward just doesn't justify the risk/uncertainty will certainly pull out of the market.
If the law is about "supercookies" and targeting an individual throughout the entire internet ... it should say that.
If its about the transfer/monetization of the aggregation of data ... PII being sold for money or some other in-kind transaction ... say that.
If a single entity uses a cookie and retains data for one single domain and that is ok ... say that.
If retaining logs that contain an IP Address and the logged in credentials are ok to keep for security auditing. .... say that ... if its only ok to store them for a year(??), 6 months(??) , 1 month(??) ... say fucking that!
If a company/site is aggregating PII of over a million unique users is troubling and should be specifically bound by these restrictions and need a DPO ... say that.
If a site only has a few 1,000 - 10,000 Unique PII records/users of note , and is not the focus of these regulations .... say that.
Give concrete examples, lawyer the shit out of it ... leave open for amendments so when abused can be modified.
It's just a shitty law trying to fix an already shitty situation.