A huge part of that was fearmongering by people selling compliance consultancy services and people trying to find loopholes allowing them to keep abusing their users' data. For a lot of companies it really wasn't that big of a deal in practice.