GDPR fixes at least some actors. There is no solution for all actors especially bad ones. But many big actors will take steps to be in compliance. Which is lot more actors than without such regulation. Perfect being enemy of better.

And at least now developers can have reasonable reason to ask do we actually need to store this or do we want to store it. Before that would have been stonewalled.