I find the EU approach so much better. Your personal data (which means anything that can be used to uniquely identify you as a person) is your property, and the default is "no permission to use".
Yeah. Information should be a massive liability. The more they know, the more it should cost them. These companies should be scrambling to forget everything about us before we're even out the door, not amassing information into huge dossiers to sell to the highest bidder. The unapologetic audacity of these people never fails to impress me. GDPR has a major problem though. It allows use of data for "legitimate" purpos…
That wouldn't be a major issue if privacy authorities actually a) acted on complaints in a timely manner, b) issued the "effective, proportionate and dissuasive" fines that the law requires.
Most importantly, I believe some DPAs have already stated that "legitimate interest" cannot justify online advertisement. Now they "just" need to take a snapshot of the most popular 10000 websites in their country, then start issuing fines.