Genuinely not, though I can understand that you're cynical. How do you prove intention anyway?
As context with these kind of regulations it's not always bad for the big players when it gets implemented across the market. Many smaller companies will not have the regulatory bandwidth to figure out compliance, and as the regulation acts as a way to level or cap what everyone can do, it's not like you will lose customers to someone else.
Complexity was mostly either definitional, e.g. some markets (ironically Germany's big publishers in particular) were absolutely convinced that almost anything they did on their sites fell under legitimate interest, even though we tried to convince them many times that would not fly.
Or it would be on specifics such as how many non-essential data providers can you reasonably ask a user to review? Keep the number too small and you'll be accused of favoring the big players, make it too big and you'll swamp users. Who decides?
By the way I agree that GDPR is pretty well written. Just that implementing these type of things and getting stakeholders to agree to it can be extremely complex. Fun days
Ha! Just because you're only getting flack for this, I once upon a long ago worked on gdpr implementation and it was exactly the same thing.
Our entire team was working overtime and liaising with regulators to figure out what some of those pretty vague statements actually meant when it came down asking user permission for third party analytics and how to ensure we were compliant (what counts as essential, how many non-essential can you reasonably ask someone to review, who creates that list, what happens to the companies not in it, etc.etc.).
Nobody else knew either because they were all looking at us, as we'd be likely to get sued first anyway. Cue the articles after launch on how we either didn't care to do it right or we were actually being our usual evil selves in sneakily not implementing it in properly.
As context with these kind of regulations it's not always bad for the big players when it gets implemented across the market. Many smaller companies will not have the regulatory bandwidth to figure out compliance, and as the regulation acts as a way to level or cap what everyone can do, it's not like you will lose customers to someone else.
Complexity was mostly either definitional, e.g. some markets (ironically Germany's big publishers in particular) were absolutely convinced that almost anything they did on their sites fell under legitimate interest, even though we tried to convince them many times that would not fly.
Or it would be on specifics such as how many non-essential data providers can you reasonably ask a user to review? Keep the number too small and you'll be accused of favoring the big players, make it too big and you'll swamp users. Who decides?
By the way I agree that GDPR is pretty well written. Just that implementing these type of things and getting stakeholders to agree to it can be extremely complex. Fun days