That's something the article should have mentioned:

4 years on, and people still think GDPR is about cookies – and even responsible for the intrusive consent pop-ups!

It is a testament to the power of the adtech giants and all the other shitty shady businesses, how they managed to twist the narrative.

And that's on HN, a presumably tech savvy audience. What chance does the "normal" population stand?