And afaik it also quite strictly regulates which data you're allowed to collect and process and for which reasons.
But on hackernews I feel it is more often than not represented as a symbol of EU bureaucracy, being to blame for cookie banners, and/or designed to extort money from poor helpless trillion dollar US corporations.
It must be freely given anyway, but its still illegal to keep unless proportional and necessary for the stated purpose.
If the purpose wasn't "we keep to resell it later" it's likely illegal.
Well, "illegal" given that this type of criminality is pretty much ignored (I've been fobbed off by the regulator after pointing a systematic law-breaking by a $company many many many times. Still better than not having this).