1. Privacy legislation existed in European countries for years (and often for decades)

2. GDPR was in the works for several years, and when it went in effect, companies were given 2 years to become compliant

3. GDPR went into effect 5 years ago, and has been enforced for 3 years

So please stop with the "poor companies could not foresee this, and didn't have the time to implement this"