GDPR: Neither Use Nor Ornament, or Just Quietly Being Stretched?

29 April 2026

Paul Francis

Want your article or story on our site? Contact us here

A Law That Promised Control

It is difficult to forget the moment GDPR arrived. In 2018, inboxes filled overnight with privacy updates, consent requests and new terms. For a brief period, it felt as though something meaningful had shifted. Companies were being forced to explain themselves, and users were, at least in theory, being given control over how their data was used.

The promise was simple enough. Clear consent, transparent data use and the ability to say no.

Person typing on a laptop with a glowing padlock and circuit pattern overlay. Purple and orange hues create a secure, futuristic vibe.

Fast forward to today, and that promise feels less certain. Not because GDPR has disappeared, but because everyday experience increasingly suggests that something is not quite working as intended. Settings are pre-enabled, choices are buried, and consent often feels like something you give by default rather than something you actively decide.

That is where the question begins. Not whether GDPR still exists, but whether it still feels like it protects people in the way it was meant to.

The Reality People Are Experiencing

Spend a few minutes going through the settings of most modern apps or devices, and a pattern quickly emerges. Features that rely on data collection are often already switched on. Options to limit or disable them exist, but they are rarely presented in a way that invites easy understanding.

Consent, in many cases, has become something passive. It is tied to long terms and conditions, accepted in a single tap, and rarely revisited. The idea of being fully informed at the point of agreement feels increasingly distant from how these systems actually work.

This creates a gap between expectation and reality. On paper, users have control. In practice, that control requires effort, awareness and persistence to exercise.

Not Broken, But Being Navigated

It would be easy to conclude from this that GDPR has failed, but that would not be entirely accurate. The law itself still sets out clear requirements around transparency, consent and data protection. It has led to real changes in how companies handle personal data, and it continues to provide a framework for enforcement and accountability.

The issue is not that the law is useless. It is that companies have learned how to operate within it in ways that minimise disruption to their business models.

One of the most significant tools in this regard is the concept of “legitimate interest”. This allows organisations to process certain types of data without explicit consent, provided they can justify a valid reason for doing so. In theory, this is a practical necessity. In practice, it can be stretched to cover a wide range of activities that users might reasonably expect to opt into rather than opt out of.

This is where GDPR begins to feel less like a shield and more like a framework that can be carefully worked around.

The Rise of Design Over Consent

Another factor shaping this experience is the way interfaces are designed.

Consent is no longer just a legal concept. It has become part of user experience design, and not always in a way that favours the user. Options to accept are often prominent and easy, while options to decline or customise are less visible or require additional steps.

These patterns are sometimes referred to as “dark patterns”, though they are not always labelled as such. They do not remove choice entirely, but they guide it in a particular direction.

The result is that many users end up agreeing to things not because they fully understand or support them, but because the process of declining is inconvenient. Over time, this shapes behaviour, turning consent into something that feels automatic.

Legal Compliance Versus Real Understanding

At the heart of the issue is a distinction that is easy to overlook. There is a difference between being legally compliant and being genuinely transparent.

A company can meet the technical requirements of GDPR while still presenting information in a way that is difficult to interpret. Long privacy policies, complex language and layered settings may satisfy regulatory standards, but they do not necessarily lead to informed users.

This creates a situation where protection exists in principle, but feels distant in practice. Users are covered by rules they rarely engage with, and decisions about their data are often made in environments that prioritise speed and convenience over clarity.

Why It Feels Like It Is No Longer Working

The frustration many people feel does not come from a single failure, but from accumulation. Each small instance, a pre-ticked box, a hidden setting, a feature enabled by default, adds to the sense that control is slipping away.

When that experience is repeated across multiple platforms and devices, it begins to shape perception. GDPR is still there, but it becomes harder to see its impact in everyday use.

That is how a regulation designed to empower users can start to feel as though it is neither use nor ornament. Not because it has no value, but because its presence is no longer obvious in the moments that matter.

The Gap Between Law and Experience

What this ultimately highlights is a gap between intention and implementation.

GDPR was designed to give individuals meaningful control over their data. That intention remains valid. The challenge is that technology has evolved quickly, and companies have adapted just as quickly to ensure that their models continue to function within the boundaries of the law.

As a result, the letter of the regulation is often maintained, while the spirit becomes harder to recognise. Consent exists, but it is shaped by design. Transparency exists, but it is buried in complexity.

This does not mean the law has failed. It means it is being tested in ways that were perhaps inevitable.

Where This Leaves the User

For the average user, the situation is both simple and frustrating. The protections are there, but accessing them requires time, knowledge and attention that most people do not have to spare.

This creates a form of imbalance. Companies understand the systems they operate within. Users, more often than not, are reacting to them.

Closing that gap would require more than just regulation. It would require a shift in how consent is presented, how choices are offered and how transparency is delivered.

A Regulation Still Worth Having

It is important not to lose sight of the fact that GDPR still matters. It has introduced standards that did not exist before and continues to provide a basis for holding organisations accountable.

The problem is not that it is useless. It is that its effectiveness depends on how it is applied, and at the moment, that application often favours compliance over clarity.

That leaves users in an uncomfortable position. Protected, but not always informed. Covered, but not always in control.

And that is why, for many, it can feel as though something that was meant to make a clear difference has become harder to see in everyday life.

Current Most Read

You Bought It, So Why Is It Changing Without You Knowing?

Stop Killing Games: The Fight Over Who Really Owns What You Buy in the Digital Age

The Crucial Role of Marketing for Small to Medium-Sized Businesses in the UK

Paul Francis
Mar 13, 2024
4 min read

Most businesses tend to ignore their marketing when things are going well, and then try to double down on marketing when things are going wrong or they are losing business, which means they end up wanting great marketing for minimal cost. This is counterproductive. When things are going great, you should spend on Great Marketing and be ready for when the bad times come knocking.

Marketing is the lifeblood of any business, regardless of its size. For small to medium-sized enterprises (SMEs) in the United Kingdom, effective marketing strategies can be the difference between obscurity and success in a competitive market landscape. Understanding how SMEs utilize marketing, perceive its impacts, and acquire marketing services sheds light on the critical role marketing plays in their growth and sustainability.

The Importance of Marketing for SMEs:

Marketing serves as a bridge between businesses and their target audience. For SMEs, it is a vital tool for building brand awareness, attracting customers, and driving sales. Despite its importance, many SMEs face challenges in allocating resources to marketing activities, especially when balancing limited budgets and competing priorities.

Take, for example, the global beverage giant Coca-Cola. Over the years, Coca-Cola has consistently invested heavily in advertising to maintain its position as one of the world's most recognized brands. In 2019 alone, Coca-Cola spent approximately $4 billion on advertising worldwide, a testament to the company's commitment to marketing despite its market dominance. This underscores the significance of continuous investment in marketing, even for established companies.

Utilization of Marketing by SMEs:

SMEs in the UK employ various marketing strategies to promote their products or services and connect with their target audience. Digital marketing has emerged as a cornerstone for SMEs, offering cost-effective ways to reach potential customers through channels such as social media, email marketing, search engine optimization (SEO), and pay-per-click (PPC) advertising.

Moreover, traditional advertising methods, including print ads, radio commercials, and TV spots, still hold relevance for SMEs looking to reach a broader audience. Content marketing, influencer collaborations, and public relations efforts further complement SMEs' marketing initiatives, allowing them to engage with consumers across multiple touchpoints.

Perceived Impacts of Marketing:

Effective marketing efforts yield tangible results for SMEs, ranging from increased brand visibility to higher conversion rates and customer loyalty. By investing in marketing, SMEs can differentiate themselves from competitors, establish a strong brand presence, and cultivate long-term relationships with their target audience.

Moreover, marketing catalyzes business growth, enabling SMEs to expand their market reach, enter new territories, and adapt to changing consumer preferences. The ability to measure and analyze marketing metrics empowers SMEs to refine their strategies, optimize their marketing spend, and maximize their return on investment (ROI) over time.

Acquiring Marketing Services:

SMEs adopt various approaches to acquire marketing services tailored to their needs and resources. Some SMEs maintain in-house marketing teams equipped with the expertise to develop and execute marketing campaigns internally. This approach offers greater control over marketing activities but may require significant investment in hiring and training personnel.

Alternatively, many SMEs choose to outsource their marketing needs to specialized agencies or freelancers. These external partners bring valuable insights, skills, and resources to the table, allowing SMEs to access professional marketing services without the overhead costs associated with maintaining an in-house team.

For SMEs with limited budgets or specific expertise, a do-it-yourself (DIY) approach to marketing may be more viable. Online resources, training programs, and marketing tools enable SMEs to create and manage their marketing campaigns independently, albeit with varying degrees of success.

Challenges Faced by SMEs in Marketing:

Despite the benefits of marketing, SMEs encounter several challenges in effectively leveraging marketing strategies:

Limited Budget: Budget constraints often restrict the scale and scope of SMEs' marketing activities, necessitating careful allocation of resources to high-impact initiatives.
Lack of Expertise: SMEs may lack the specialized knowledge and skills required to navigate complex marketing landscapes, particularly in digital marketing and emerging technologies.
Time Constraints: Managing marketing activities alongside day-to-day business operations can strain SMEs' resources and personnel, leading to inefficiencies and missed opportunities.

Adaptation to Digital Marketing Trends:

With the proliferation of digital channels and shifting consumer behaviours, SMEs are increasingly embracing digital marketing as a core component of their marketing mix. From social media marketing to search engine optimization, SMEs leverage digital platforms to engage with their audience, drive website traffic, and generate leads.

Data-driven insights and analytics empower SMEs to optimize their digital marketing efforts, identify emerging trends, and refine their targeting strategies for maximum impact. Moreover, the rise of e-commerce and online marketplaces presents new opportunities for SMEs to expand their reach and diversify their revenue streams in the digital space.

Marketing plays a pivotal role in the success and growth of small to medium-sized businesses in the UK. By investing in effective marketing strategies, SMEs can amplify their brand presence, drive customer engagement, and achieve sustainable business growth in an ever-evolving marketplace. With the right approach and resources, SMEs can harness the power of marketing to thrive amidst challenges and capitalize on opportunities for success.