What bothered me the most is that they vaguely referred to Europe's data protection having more teeth, even though the GDPR has all but been neutered via Legiti

What bothered me the most is that they vaguely referred to Europe's data protection having more teeth, even though the GDPR has all but been neutered via Legitimate Interest. Most GDPR popups now classify "building a personal profile", "serving personalized ads" and "linking multiple devices" as legitimate interest, and they still default it to on, without a clear and equally-visible "No" button next to the "Agree". This is so obviously against the intended spirit of the legislation but it's everywhere. So yeah, large targets like Twitter might need to watch out, but third parties are still harvesting data left and right, so what's the point?