Many industries are already like this. Certainly anything that touches securities laws or payments. Or safety regulations, or government customers. It was once

Many industries are already like this. Certainly anything that touches securities laws or payments. Or safety regulations, or government customers. It was once possible to start a bank (Goldman Sachs origins buying receivables), a hedge fund, PayPal, etc etc without heavy compliance costs and infrastructure. Then things change. Though GDPR has a longer history, the US election showed that data-collecting people-connecting internet companies can do even more systematic damage and e.g. permit more foreign election manipulation than any one financial institution. They might not crash an economy but they can crash a democracy. So really the regulation is somewhat deserved and levels the playing field with other industries that have the potential to damage society. Personally I wish two people could start an internet company or a bank or an exchange or an investment fund without deep pockets for compliance and legal. But it’s no more. Mourn it and think about the next sector that is open for growth.