I think GDPR receives an undue amount of emphasis here. The history of Europe, the European union and the evolution of its laws make it clear that European cult

I think GDPR receives an undue amount of emphasis here. The history of Europe, the European union and the evolution of its laws make it clear that European culture values privacy and sees threats to privacy as a particular problem worthy of concern. It has been a slow evolution from my perspective. I came to the European Union around 2006. Facebook started to become popular, myspace was starting to collapse. Smartphones were rare at that time and not really recognizable as such. The internet giants were not so giant at that time. In Eastern Europe during the cold war, spy networks caused a lot of problems for people, and most people in Western Europe were and are still keenly aware of these problems. Note that a right to data protection and privacy existed in the EU since 1995, well before I arrived. Around that time, a big scandal in the country I was living in was the knowledge that telephone records had been leaked to the security services without a warrant. Bear in mind that such a thing doesn't require a warrant in the USA and you can already see a difference between US and EU culture on data protection. On the other hand, legislation was proposed which would eliminate the warrant requirements... sadly I'm not sure what became of it. The next big things that happened were extreme popularization of facebook, google creating search bubbles and android and iphone launching. People started to realize that these companies knew a lot of information about them. A sort of right was created in Europe (ostensibly it already existed via the 1995 directive?) to be able to access one's data. A large fight against Facebook was started to gain access to one's data. That triggered two things. People were astounded at the extent of the information that they had willingly submitted, and people noticed that they were not given access to the information that they had not willingly submitted. As in, Facebook showed you the posts you made, but didn't show you the log of websites you had visited while logged into facebook and a like button was shown. This brought a lot of focus onto tracking cookies. Enter the tracking cookie law. Most people just refer to it as the "cookie law", but what the law actually does is distinguish between necessary cookies like session cookies and long lived, permanent cookies or short lived cookies for tracking purposes. The intention behind this law was, drive companies towards the use of short lived session cookies and away from tracking cookies. It was light touch in that there were no real fines. It failed miserably; you can blame the legislators, but companies showed no willingness to abide by the spirit of the law and just put blanket consent banners in front of users with only a Hobson's choice. The GDPR added teeth. With fines proportional to revenue. With definitions about what consent needs to look like to avoid the cookie loopholes. Moreover, the right to delete your data. TL,DR: privacy concerns eroded in the USA in the telephone era while Europe was at that time keenly aware of the dangers of spy organizations and friends and family spying on you. As technology evolved, Europe has tried to keep pace and define what the right to privacy means in regards to the newer technology. These are my opinions as a tech savvy, privacy aware, resident of the union.