Cookies are a tiny part of what the GDPR is about (and it isn't even the main regulation that covers them). It's what people associate with it because adtech co

Cookies are a tiny part of what the GDPR is about (and it isn't even the main regulation that covers them). It's what people associate with it because adtech companies have made cookie banners deliberately obnoxious for that very reason. The vast majority of things covered by the GDPR are about the day-to-day protection of everybody's personal data, whether that's medical records, CCTV, employment records, insurance etc. Most of the provisions in it were already the law in most of Europe: it just standardised the rules and enforcement procedures. The main problem with the GDPR is the lack of enforcement, which is largely down to the lack of resources in the national privacy regulators in member states.