The big impact for me was on the non-online tracking and mishandling of private information. All kinds of local non-online service providers and companies (e.g.

The big impact for me was on the non-online tracking and mishandling of private information. All kinds of local non-online service providers and companies (e.g. store 'loyalty programs') started to take data privacy and (non-)collection much more seriously, significantly changing their policies and activities. There are still all kinds of unacceptable activities, but now they're (a) rare and (b) clearly forbidden, so we don't see local corporations flounting 'sorry-not-sorry-we-did-nothing-wrong-and-will-keep-doing-it' PR after they've been caught doing something shady. So there's been a big change on how my data is being handled in the real world - any effect on random websites online are just a nice-to-have bonus, it's sort of moving in the right direction but it's obviously not a priority in enforement and a better treatment for that can be tweaked in a next version of GDPR, the important thing was to tackle all the big relationships (and privacy abuse potential) people have with e.g. their cell phone provider, supermarket chains, lenders, etc, which are now mostly 'clean' and the major online players such as Facebook, Google, etc which will probably require years in courts.