It's both. The legislation, while based on good intentions, isn't exactly a prime example of an easy-to-implement, consistent set of rules.

There's no excuse for larger players to not implement these rules. Many smaller players however, struggled and in some cases still struggle with this because some of the rules are rather vague (sometimes intentionally so in order to be future-proof) and hence open for interpretation.

There's the rub: While the law is clearly targeted at larger companies - to the extent some have called it Lex Facebook - it's the smaller companies and hobbyists, for whom implementing GDPR is more of a problem. I wouldn't be surprised if, in the long run, companies such as Facebook actually benefited from GDPR, at the expense of smaller competitors.