> But Americans expect law to in general work more like a list of checkboxes
To me as a European, this is a very low-trust view of lawmaking that assumes a hostile relationship between a government and its people.
The European approach is a bit more of a living conversation.
In the implementation period there's workshops where you figure out how to best comply in a way that makes sense for your business. There's a lot of flexibility there since you're just aiming for the spirit of the law, not some formal definition that might not make sense in your case.
If you're found out of compliance theres a bit of a back and forth and if you put in a good-faith effort to fix things, nobody has any issues.
The advantage of this approach is that the government doesn't tell you how to run your business and things stay agile as new use cases and business models come up.
It works out pretty well in general, and allows for a more cooperative approach to reaching policy goals.
Problems usually only arise when American companies try their bad-faith technicalities and find that doesn't fly here, like when Facebook changed their ToS to try to argue that using their services itself constitutes consent under the GDPR and predictably got dinged for it.