I understand why people point to GDPR but I agree that it is misguided. Mostly Americans see the dark patterns (when I use a European VPN the experience is generally smoother). The much larger share of the blame is on the companies, the ones who got us into this mess in the first place. And there are egregious examples like StackOverflow which just have no excuse.