GDPR is pretty serious about levying fines. I'm not sure most US-based developers or companies are really up to speed on what could happen. Obviously FB didn't take it serious enough.