Everything would be a different paradigm than we have now. Security, auth, sharing; we can only imagine how things would shift if we turned the model we have on its head. Super cookie? ISP is a private VPN proivder now.

Cookies are a good example. That browsers give up a cookie at all—who consented to this specification? GDPR could have changed browser specs so that cookies were truly opt-in; it regulates company behavior instead, which is weak.

Fundamentally, our choices are being made for us at the protocol level, and everything we have as a result is emergent, and so people argue about regulating the emergent properties.