In practice though with the GDPR, sites either just 403 everyone in the EU to avoid complying, or just shower you in javascript cookie notifications, making your browsing experience more bloated, slow and insecure.
(b) many people make the disagree button small, hard to see, or require clicking through multiple screens to get to
GDPR really should have dictated "agree" and "disagree" be of equal visual weight and button styling and dictated disagreeing to be a 1-click action.
I'm pretty sure that everyone doing our (b) is not compliant at all. The problem is that GDPR isn't being enforced very well.
It does mandate something to that effect: the user should not have to spend more effort to disagree than to agree.
The GDPR applies to all processing of all personal data regardless of whether that's pieces of paper in a filing cabinet or an entirely online social network.
Insurance? Private doctor? Youth services? Family (or any other) court? Pharmacy (in most of Europe)? Police (even in the most trivial of cases, and without judicial approval, and of course without verification or recourse)
Worse than that: the exception goes further than merely keeping data as well. Insurance company wants to change/add to your medical record? Immediately? Doctor? Court? Police? All can change your medical file, both adding and deleting (sometimes limited to what they added themselves). YOU want to change it? Not possible!
Weird since insurance company access to your data, and "the right to be forgotten" was one of the main selling points of this legislation, but since insurance companies are semi-government in almost all of Europe these days, a lot of them fall into the blanket exception.
And of course, you yourself ... cannot access this data. You cannot see it (sorry "you can, unless there's a reason not to let you see it", wanna bet there's always a reason?). For particular parts (espectially names, for example which doctor put something there about you are kept secret from you). Thankfully these institutions hate eachother, so there is some protection left because if anyone wants this data, they have to file requests in 5 different places. But there is no more legal protection against this happening.
It is now far easier, in the Netherlands, to get a serious crime stricken off your judicial record than, say, getting a doctor or pharmacist's claim that you falsely came in for a heart problem out of your medical file, say to threaten or attack them for painkillers, or even just getting the name of which doctor put that there (and of course such misleading information can kill you if you ever really do have a heart problem, and god help you if you need pain killers or ...)
GPDR protects you from Amazon offering you gift ideas for your kids' birthday if you object to that. You want a mental health stay 40 years ago to not be used in a family court case against you? THAT it makes MUCH easier. Faking such a thing and using it in a court case against you, that, too, it makes a lot easier.
https://ico.org.uk/for-organisations/guide-to-data-protectio...
As for the "you can't get data removed or even access it", here's some specific examples:
https://ico.org.uk/for-organisations/guide-to-data-protectio...
https://ico.org.uk/for-organisations/guide-to-data-protectio...
Like everywhere else, medical and "social work" data (and keep in mind that both the medical and social workers can lock people up for extended periods of time, even in isolation. Extended means decades, even until death, and that under circumstances that are justified using records on which that applies. You can't access, remove or change that data, but it can (and is in practice) used to lock you away legally indefinitely)
Insurance:
https://ico.org.uk/for-organisations/guide-to-data-protectio... (NHS is the insurer in Scotland. Essentially, ANY data that can be used for legal purposes (whether to sue you or to defend itself or any decision it made) is exempt from GPDR. No matter how personal the data. Technically this may even cover publishing such data.
I realize this is for one specific part of Europe, but there are analogues everywhere. And, frankly, look at the size of that list. It's only the beginning, on the left, click open, "right to X" and there's yet another list of exemptions.
Purely anecdote, but zero companies I know in Germany, Italy or France are doing this. (The ones in Switzerland are.)
There is a cosmetic fix that produces an email so there is something to show a regulator if they come knocking. The logic being investing anything more than that is a crap shoot, given nobody knows how each of the EU’s 28 data regulators will interpret the rules.
In France in particular the right to access/change/delete any and all data a company has on you was there long before GDPR (by decades) so most serious company are well used and prepped for it.
They range from start-ups to national champions, but I won't disagree with you on the poor organization of most European companies point. Everyone one re-papered existing systems to some degree of compliance. Given nobody agrees on what full compliance is, they're all right in their own ways.
With Blizzard it went a bit different. They do have online automated tool to download your own data, but with a twist: they refused to provide what they consider security risk information. They did provide a lot of data (even years old chat logs) but did not provide the information I was looking for: list of processes running on my PC, which they scan periodically, as an anti-cheating mechanism. I went further and filed a GDPR infringement complaint to the national office but it failed. Last option was to sue, but I gave up.
Both Epic and Blizzard are US based.
But from what I have seen, most of that time was spent on the legal and policy site, not on actually implementing the technical changes required to properly handle, store and delete data.
I can absolutely guarantee you that the overwhelming majority EU companies could not properly carry out a GDPR deletion request.