I think that the primary target for GDPR investigations is going to be the big actors like Facebook, Google and Advertising networks who's single business model

I think that the primary target for GDPR investigations is going to be the big actors like Facebook, Google and Advertising networks who's single business model is profiting from user data. Big online marketing companies are looking at a variety of technologies to turn their user's into buying customers of their advertising customers both online and in-store. Look at Facebook as an example with their dreadful user interface attempt to trick EU customers into opting-in to facial recognition technology. https://venturebeat.com/2018/04/18/facebook-engages-in-privacy-zuckering-to-get-user-consent-for-facial-recognition/ https://venturebeat.com/2018/04/18/facebook-engages-in-priva... But there's a good reason for this. The ability for stores to know who their customer is, what they buy and re-market to them is powerful, and incredibly creepy. https://www.pymnts.com/facebook/2017/facebook-patent-facial-recognition-authentication/ https://www.pymnts.com/facebook/2017/facebook-patent-facial-... http://www.thedrum.com/news/2017/12/01/facebook-reportedly-develop-facial-recognition-technology-help-shops-enhance http://www.thedrum.com/news/2017/12/01/facebook-reportedly-d... I now turn my phone into flight mode before I enter a high street store. https://www.kaspersky.com/blog/offline-tracking-ads/16510/ https://www.kaspersky.com/blog/offline-tracking-ads/16510/ GDPR is a good reminder to all companies that the individual user owns their data, not the company. I personally like this shift, which will over time make companies think about the business models they implement, encouraging us to have customers rather than users.