The problem is, it's not a handful of companies, it's a few hundreds or even thousands, which makes rigorous laws sensible.
Google, Facebook, Twitter have a roster of the web pages you have viewed, whether you interacted with them or not.
Verizon, AT&T, T-Mobile and every other phone company has a complete log of your location history (for mobiles), message & call history, and unencrypted browsing history. They have no need for it to provide service (beyond the month or two in which these actions occured), but they do sell it to third parties, the list of which you have never seen.
Your credit card company does the same with your credit transactions.
This is already 30 companies or so, just in the US, and it is just the tip of the iceberg.
GDPR says "a person's data is their own property", which is easy to understand and enforce. You may not like it, but it's along the line of copyrights and trademarks, except the beneficiary is mostly the common man.