GDPR is about personal data, not just cookies.

I agree they should have thought better of that cookie law, which is a different one. But GDPR really was and is on point.