I think GDPR is overall good. Specifically, I think people have a right to know exactly what is being done with their data, and sites should be accountable for protecting that data.
On a strictly personal note (speaking only for myself), I am willing to exchange my privacy for web content and services. I'm happy to let sites like Google, Facebook, and Apple track me, share my interests with their partners, and all that other stuff. In return, I enjoy using their sites without having to pay them. I love Gmail, my Facebook group, etc.
That's the one place where I think GDPR has gone too far. I will comply, but I don't think the regulation is fair. They are impeding the rights of publishers in order to maximize the rights of visitors.
I can invite people to a private event such as a music concert where a stipulation for attendance is to be searched via metal detector for weapons. People can choose to give up their privacy (allow the search) or not attend the event.
Why can't a website do the same thing? Why shouldn't a publisher have the freedom to say "If you use our site, we we will use cookies to track you and your interests and sell this information to X, Y, and Z. If you don't agree to this, please do not enter the site" ? In my opinion, that is perfectly fair, transparent, and not an all an abuse of the visitor's rights.
What gives a visitor the right to visit a private site when they are unwilling to pay for services in the format which that private site has chosen?