zlacker

I'm not certain about the other memberstates but to my knowledge the privacy law hasn't changed that much. There is a good increase in the amount of generating an audit log of any privacy sensitive stuff you do and of course the various "Right to be *" variants but those are largely non-issues.

German courts already considered a EULA or "check box to consent and get thing" a non-binding consent (to some extend).

Largely, if you are running afoul the GDPR in germany there is basically two options A) you rely on adsense a lot and B) you ran afoul the previous laws already.

So, overall, I would say that yeah, most of the stuff forbidden by the GDPR was already forbidden. The GDPR grants you new rights and requires corporations to ensure compliance however, that's new.

Plus the teeth in form of pretty hefty fine limits. Which is good IMO.