Part of the problem with the GDPR is that although many people believe that what you wrote is roughly what the GDPR says and although much of what you wrote is

Part of the problem with the GDPR is that although many people believe that what you wrote is roughly what the GDPR says and although much of what you wrote is probably more true than not, almost nothing there is strictly correct and in a few places it is wildly misleading. It's not just about collection of data but also about how you process it. Consent is only one of several possible lawful bases for processing, and in practice it's one that many experts have advised against relying on any more than necessary. The right to erasure is actually quite limited in scope. There are multiple mechanisms by which data may be legally shared with other parties, and there's a whole controller/processor system you haven't touched on in relation to that. There are grey areas and ambiguities all over the place, and there are widespread misunderstandings even on points where the GDPR itself is reasonably clear, not helped by media reports often getting the facts wrong themselves around two years ago.