Same deal for the California Consumer Privacy Act.
These are laws which people hoped for, and got done.
Ultimately, it increasingly seems like advertising-surveillance as a business model may not be one we want to live with. The costs are externalized very effectively, and it’s kind of hard to know what to do with them.
The right not to be subject to automated decision-making is a typically short-sighted example.
Based on what are you saying this? As long as the rules are the same for all competition in a market will still happen.
I also hope that the GDPR will move the focus of innovation away from sucking up more and more data to do better advertising to other areas.
Sure, but in continental law the rules aren't the same for everyone. The laws are defined such that technical breaches are almost impossible to avoid. They empower a regulator with capricious and arbitrary power to sanction organisations - or not - with no requirement for consistency or recourse.
The answer to any technical question along the lines of "Is X illegal under the GDPR?" is "Nobody knows - we'll find out once the regulator fines someone."
That's bad law-making.