I order a pizza, I have no choice but to provide details since they need them for delivery. Guess what happens next? Yeah, e-mail and SMS spam.
I pay hundreds of bucks for a complete Tado system (thermostat, radiator valves, etc). Guess what I get? E-mail spam about discounts for their "new" app which actually has less features than the current one.
I buy a PS4 and try to set it up. Even for a few hundred bucks for a new console, there is still bullshit telemetry and other crap I need to opt-out of, not to mention some half-assed attempt at a social network where I have to spend 15 minutes setting everything to "No one can see this" so I can regain some privacy because I have no desire to use the social features.
Heck, even some US government agencies (DMV I think) sell your data to scum and you can't even opt out.
I can go on and on. We need some actual ethics, and regulation as a fail-safe for cases where the former doesn't work.
Or become an EU resident and use their brilliant data-handling privacy laws
Can you imagine doing all these things every time your privacy is violated (every non-compliant cookie banner, tracker, newsletter, etc)? That would be a full-time job. It's almost like "justice" in the US, in theory you can win, in practice you have no chance unless you have billions to pay lawyers to fight decade-long legal battles on your behalf.
But GDPR is just the 2nd step. The 3rd is the e-privacy regulation that is coming, hopefully in this mandate.