[closeparen]

All information centralizing in the hands of the few companies that can afford the consultants and lawyer time to figure out what the GDPR even means is an unambiguously worse outcome for people’s privacy.

I would go so far as “any company with a mature regulatory compliance function is an extreme threat to your privacy and not mitigated in any way by the GDPR” and “any company small enough to plausibly be found in noncompliance with the GDPR was never a threat.”