While I agree with your points, I should say that for the absolute vast majority of sites and businesses out there GDPR is trivial and amounts to "don't collect PII data, and don't sell it to third parties".
A handful of businesses with their hands in multiple pots may have more trouble.
The GDPR says none of that. If it does, I'd love to read that section because I've never read it before. It just said you have to tell who you're selling it to and how you're using it.
It's basic human shit. If I lend you a book and you lend it to one of your friends, I'd expect you to let me know; _before_ I ask you for it back. This is basic human decency, (I think?). This law was enforcing basic human decency that companies seem to have forgotten along the way.
A handful of businesses with their hands in multiple pots may have more trouble.