I'm not understanding, as an European who's been part of multiple startups how's that supposed to boost growth. There's literally 0 startups I've been part of where data protection laws or even the infamous cookie banners have been anywhere near relevant (unless your business was literally profiling). In fact the actors that most opposed those laws have always been non Europeans. Sure, there is an attached cost in ha…
One day I got a letter from the national authority regarding personal data where I was asked to reply to 15 questions regarding a personal project of mine, invoking the GDPR. The sanctions for not complying within 5 days was an incremental fine of 600 euros PER DAY, until I complied. This letter was directed to me as a natural person (not even my company).
Another story: I had a publishing website with some ads on it. The moment full GDPR went into effect, some years ago, revenue instantly dropped by 30% because the cookie banner I was using wasn't part of the approved european framework for cookie banners (they created an entire organization for this, called IAB). Most of the "approved" cookie banners are insanely overengineered nonsense and almost all of them cost a lot of money. And they kill your performance metrics. And when I finally gave in and implemented one of those, revenues dropped even more because I was losing readers who just quit without consenting at all.
Third and final anecdote: at one point I was contracted by a Romanian DTH television company who mostly operated with prepaid customers. According to GDPR, they were supposed to anonymize data they no longer needed, but because their clients were seasonal or less predictable, that turned out to be ridiculously hard. Their legal department, together with external contractors such as us ended up spending months to adjust their systems to conform to GDPR, and the result was their losing business and time, while being unable to properly serve older customers because they could no longer identify them.
So in my opinion, despite originally being well intended, GDPR opened a huge can of worms, created a lot of issues and made everyone's life harder on the internet, for no real benefit. On the contrary, the large companies could afford the legal counseling that they needed, but the smaller ones were hit hardest.