The General Data Protection Regulation (GDPR) (EU) 2016/679 that goes into affect tomorrow has some pretty cool provisions. I really like the right to be forgotten. Today, once an online entity gathers information on you, they pretty much keep it forever. GDPR also encourages pseudonymisation. All around, these are good things for consumer rights. Also, if your business gets hacked, you have to report it within 72 hours. This is nice - many companies have not reported hacks in the past for various reasons...
When/if a company goes under this month because they could not follow the GDPR standard, think about what that actually means. If a business model is based on trickery, maybe it should not be in place..
[1] https://en.m.wikipedia.org/wiki/General_Data_Protection_Regulation