I can't read the paper beyond the summary. But for what it's worth, I agree that GDPR is a good thing in general. However the implementation and execution of it

I can't read the paper beyond the summary. But for what it's worth, I agree that GDPR is a good thing in general. However the implementation and execution of it is sloppy (as seen with these "dark patterns") GDPR should have been aimed at the browser and then force websites to comply with the settings defined in the browser. Non-compliant sites would be immediately flagged by the user's browser instead of hiding behind numerous dark UI patterns. Perhaps it was easier to force thousands of EU sites rather than trying to coerce Google, Apple, Microsoft.