GDPR's success is measured by the intensity of its corporate critics

The efficacy of the General Data Protection Regulation (GDPR) is often debated through the lens of user frustration, but a new perspective suggests that corporate animosity is the true metric of success. Writer Mat Duggan argues that the regulation is achieving its goals precisely because it is loathed by the entities it was designed to constrain.

In a recent essay, Duggan posits that the visceral hatred expressed by data brokers and tech giants serves as primary evidence that GDPR is effectively disrupting their business models. To illustrate this point, Duggan invokes the words of Franklin D. Roosevelt, quoting the former president: "They are unanimous in their hate for me—and I welcome their hatred."

The friction of regulation

Implemented by the European Union, GDPR was designed to grant citizens greater control over their personal data. While privacy advocates have praised the framework, the tech industry has frequently criticized the regulation for its complexity. Simultaneously, the general public has grown weary of the proliferation of cookie consent banners that now dominate the web experience.

However, the discourse surrounding Duggan's essay—including a subsequent discussion on Hacker News—suggests a distinction between the law's intent and its implementation. Participants in the discussion claimed that the ubiquitous cookie banners are not a direct mandate of GDPR itself, but rather a form of "malicious compliance." This strategy, they argue, is designed to make the regulation appear burdensome and annoying to the public, thereby undermining the law's reputation while companies continue to resist its core objectives.

Why the tension persists

This debate highlights a fundamental tension in modern tech regulation: the gap between legal requirements and the actual user experience. If the "annoyances" of the modern web are indeed symptoms of corporate resistance, then the friction users feel is not a failure of the law, but a sign of a struggle over the limitation of data collection. The resistance from the "establishment" suggests that the regulation is hitting its target by making the unrestricted harvesting of personal data more difficult and costly.

What remains to be seen

As regulators continue to refine how GDPR is enforced, the focus remains on whether the law can move past the era of malicious compliance. The central question is whether the EU can eliminate the performative friction of consent banners while maintaining the disruptive pressure on data-harvesting business models that Duggan identifies as the regulation's primary victory. If the hatred of the regulated persists, it may be the only reliable indicator that the law is actually biting into the profits of the surveillance economy.