Exactly. If you read the cases, a fair number of them are gotcha type things. For example, ask yourself, if google tried to say they couldn't provide consent records (despite CLEAR language in GDPR) because they are only stored on devices - I have a feeling a MAJOR fine would be inbound.

But we get expert advice here that it is fine.

One of the claims I saw was that google hadn't said something about information being used to advertise - but when I read the related disclosure (they have all the versions) it seemed clear enough to me. I'm not saying ruling was wrong, but they in some cases hinge on issues just like this.

And we are just scratching the surface of things here.