The way GDPR hurt smaller companies wasn't so much that the regulation directly applied to smaller companies but that larger companies, due to the liability the

The way GDPR hurt smaller companies wasn't so much that the regulation directly applied to smaller companies but that larger companies, due to the liability the regulation presented, no longer felt comfortable working with smaller vendors who they felt couldn't provide the assurance of GDPR compliance. External vendors became riskier that everyone reduced the number of vendors and partners they wanted to work with (either directly or indirectly), which had the cascading impact of smaller companies being cut out of the ad ecosystem and Google becoming much more dominant. Now I'm not yet familiar with this draft nor with how it's likely to evolve from this point on but you have to do one or the other. You make the regulation overarching enough that partners' lack of compliance affects your own compliance efforts, in which case smaller players are going to have a hard time competing and will be cut out of the ecosystem by legit big companies who have more to lose than you do. If you don't do that and it becomes relatively easy to outsource data-related liability to your partners, there will be a loophole where shady data collection and processing activities will tend to aggregate and move towards entities that are either exempt from regulations or at least willing to take on liability for their customers for short-term gains. The latter is distinctly worse than the status quo because you're making the problem worse. The former is arguably bad for the startup ecosystem. My understanding is that smaller players are, in the aggregate, much worse about pretty much everything and the effectiveness of GDPR-style regulations depends on the impact they have on smaller players who are much further away from compliance than the big tech companies who were for the most part never too far away from compliance and whose bottom line never depended on any of the alleged shady practices. Most people aren't aware of smaller ad-tech players or data vendors so often their (and their customers' or partners') wrong-doings are blamed on the big tech companies that are much more visible. To a large extent, what happened in the ad ecosystem is that smaller shadier ad tech companies forced everyone else to become shadier - if they are out there promising marketers more data, better tracking and more accurate measurements and they are accomplishing that through questionable practices, that still raises the bar for what marketers expect and they are able to force their way into integration with other platforms or at least force everyone to do similar things. Ultimately, there's a trade-off between transparency and measurements for marketers and privacy and a world dominated by lots of small players who don't trust one another is one where marketers are forced to require proof that their money is being well-spent, which means more privacy-defeating tracking and measurements.