> GDPR was great in principle but all we ended up with was annoying cookie pop ups.

Read through this list - there's more than just cookie popups:

https://www.tessian.com/blog/biggest-gdpr-fines-2020/