Actually a lot of large companies are not compliant with GDPR on many levels and while in some cases that's not true, in many it's not necessarily due to malint

Actually a lot of large companies are not compliant with GDPR on many levels and while in some cases that's not true, in many it's not necessarily due to malintent. A ton of data is collected by thousands of developers in their products all across the globe and the data is never really cleaned or checked in any way. And in some cases the data that is being collected is so enormous that no one can really answer for certain what goes in there. I know dozens of companies which have thousands of products and each one of them has at least one database behind it. I doubt anyone in the company will be able to tell what a product with 2000 users called Xx developed by two people in Sri Lanka for instance complies to all GDPR guidelines. Frankly most of the people in the company would go "Xx? What's that?". But that product could very well be storing users' location, IP address and so on without their explicit consent in /var/log/debug_connect.log on a server somewhere.