I think the law requiring subscriptions to be easily cancelled is a good example of something that is good for people because it makes something they already want to do easier/better.
On the other hand, the thought of having to cope with umpteen different privacy laws makes me glad I don’t work on a website for the general public.
My main complaint with data protection laws is that they often require actions from users, either some kind of ‘informed consent’ like gdpr/cookie laws, or some kind of deletion request. I would much prefer some simpler laws like ‘no keeping behavioural data more than 45 days’ that don’t require people to opt in to privacy. Though there are flaws with what I wrote – what does it mean for training neural networks; there are cases where you want that memory, eg maybe if you liked a tv show/YouTube channel and there was more than 45 days between series/videos, you would want the new series to be recommended to you; there are complex chains of causality like if eg I watch a cat video, get recommended a bunch more cat videos over time, watch some of those, then in some sense the signal from the first cat video has caused me to still be getting recommended them more than 45 days later.
It seems like this requires taking action to delete a lot of data from a lot of places and puts the onus on the consumer, which I think isn’t great. But the ‘data broker registry’ might make it easier to do? I wonder what the EFF were thinking about when they supported this. Perhaps they just considered it to be strictly privacy-increasing and therefore good, and didn’t worry about second-order effects like consumer fatigue. Maybe the second-order effects don’t matter so much – they are second order after all.