Which is why a contract is insufficient as a form of consumer protection. Think GDPR - i think despite the disruptions as a result from it, GDPR has done a fair

Which is why a contract is insufficient as a form of consumer protection. Think GDPR - i think despite the disruptions as a result from it, GDPR has done a fairly good job in forcing rules so that companies complying is considered to have provided sufficient privacy and data protection. Why not produce such a set of rules for consumer protection?