Spoken like a person who never even touched it even on a small project.
No cookies... so no language preferences. That is a profile cookie.
Right to erasure. What about invoices and orders? When can it be anonymous and when is it old enough to anonymize.
Do I get away with replacing personal data random data? Do I replace references to real people with 'anonymous person'? Will my sql constraints still work?
When I restore data from backup and someone has been anonymized in the meantime, what mechanism will be used to anonymize the user after restore?
Right to data portability. How much of the database and in what format?