GDPR, like any big new law, has plenty of weird unintended consequences. But it’s a major step forward for privacy and consumer data rights regardless.
(Cookie banners are the most obvious example of this. The businesses say “our hands are tied, the EU told us to do this”, whereas in actual fact the EU more told them to stop doing the storing and collecting. And very few cookie banners and such actually comply, and they made them a much bigger deal than they should have legally. All up there was very clear intent to poison perception in many cases.)
Also, a lot of the problems are not bad actors finding ways around the law but straight up violating it. The most prominent example is the consent bannes that try to discourage the deny option in various ways. The lawmakers did anticipate that kind of maliciousness and made sure to disallow it. What is lacking is mostly enforcement, and that is not something the lawmakers control.
Yes, emphatically. It's a one-time change for the admin that allows them to maintain the status quo, and they don't visit the site as often as users do.