The GDPR changes the rules under which data colonialism operates but leaves unchallenged the commercial purposes for which data is collected. There is also a question about the limits of the “informed consent” principle on which the GDPR relies; this principle is dependent on how situations of consent are configured in everyday life. It is hard to see how this, or any similar general framework that we might imagine, would challenge an environment in which consent to data collection and processing is overridden by the bargaining power of employers or insurers. Meanwhile, it is super-powerful incumbents such as Google that are arguably best placed to bear the costs of adjusting their business to GDPR rules.

Nick Couldry & Ulises A. Mejias, The Costs of Connection, loc. 555