Any company effected by GDPR is at risk of being fined a (relatively) large sum. Even if the compliance cost of GDPR appears low, the regulatory risk is large

Any company effected by GDPR is at risk of being fined a (relatively) large sum. Even if the compliance cost of GDPR appears low, the regulatory risk is large enough that companies have to bear the cost of legal staff to deal with that possibility. Big companies are in a much better position to pay for such things than small companies. Moreover, startups seeking capital must convince potential investors that the chance of being wiped out by a GDPR complaint is low -- on top of convincing those investors that their business model is viable, that they are entering the market at the right time, etc. Plenty of startups with great ideas never get off the ground because they cannot get the initial capital they need, or they fail to get enough capital to survive a rare negative event. There is not much doubt that regulations raise the cost of entry to a market. The real question is whether or not it is worth it for society -- if we are willing to sacrifice a few small companies for the sake of the regulatory goal. User privacy is a fine goal, but the EU is losing the leadership it once had in the tech industry to the US and China. Where is the European answer to Google, Facebook, Tencent, or Alibaba? Where is the Europe in the AI race? It is not just GDPR; the right to be forgotten, the draconian copyright rules, and so forth have all contributed to a stifling regulatory environment in Europe and a stagnant tech industry.