GDPR could have been great, if it was actually enforced in the way it was intended. Cookie banners and dark patterns are not actually allowed, but without enforcement, it's basically meaningless.

IMO the biggest issue is that the member states are individually required to set up agencies to police this. This makes perfect sense for local companies, but is meaningless against large entities that operate across the entire EU.