What will your company do for California users, and other states as they adopt similar privacy laws following the success of the GDPR?
Personally I don't have a stake either way in the matter. I can see the argument from both sides. But the entire point of a business is to generate revenue, and we can't do that if we start trying to comply with every local chirp and by-law places decide to pass.
Supporting the GDPR isn’t free, those technical and legal costs have to be justified by saving an appropriate amount of lost revenues.
All laws are nuanced, just thinking that you are already doing the right thing isn’t enough to avoid legal liability.