For me the biggest flaw of GDPR that it does not distinguish between something done as a business to make money and something done non-profit, as a hobby project, etc. GDPR killed forums, etc. everything moved to Facebook groups, where people agree to whatever Facebook wants. Who will create forum for a community if one has to deal with all the bureaucracy, "right to be forgotten", data accuracy checks, data export r…
The centralization of the web on very few commercial platform has many reasons, data protection is probably the least important and might even be a counter-force in my experience.