GDPR only matters if the EU has jurisdiction. If it's a website run from China then GDPR can't really do anything. A better first step would've been to limit the information that's being sent out in the first place - the browsers and OS. If people had better control over what their computer sends out then the privacy issues would be much less worrying. After that you can talk about limitations on who can do what with the data. Just having the latter means that people are still leaking all of their data, but companies are basically just promising not to use it.