If the company handled user data responsibly already, it means the company was already respecting the privacy laws already in place in major European countries,

If the company handled user data responsibly already, it means the company was already respecting the privacy laws already in place in major European countries, Australia, etc and GDPR compliance shouldn't cost anything. There's also no such thing as responsible data handling for services tracking users without their consent. If no explicit consent was given, consent obtained with a layman explanation and with no dark patterns, then it shouldn't be legal. The problem often isn't how the data ends up being used, the problem is that the data is collected in the first place.