Anecdotal observation from big-ish corps in EU: everyone started trying to look very mindful about what data they ask for in the first place, what gets stored where, what is shared with whom. In some cases, this led to actually being more mindful about those. At least in e-commerce, GDPR worked in the privacy-minded consumer's benefit to some extent, and not quite against anyone.