I think you misunderstood my point, which was that we're clearly seeing a massive global trend towards privacy and rights thereto. The GDPR is a manifestation of this trend, and has further sensitized consumers.

Cambridge Analytics happened at a time when neither processors nor consumers were yet very sensitive to the topic of privacy. This has changed dramatically, and the GDPR is not the cause thereof, but a consequence thereof.

Of course the GDPR is not binding in California, but it should be at least thought-provoking in California.