Despite this weak enforcement (and despite shoehorned, ill-starred clauses in the GDPR like the “right to be forgotten”), the core of the GDPR is solid. It says that online service providers may not capture, store or process your data without your enthusiastic, freely given consent.
