It's a supranational institution that dictates laws to States, with a budget and coercive powers against States. It just lacks an army of its own. Whether it's a proper state or not doesn't matter.

> conceptualised in the EU

No, in Europe. No EU bureaucrat conceptualizes things. EU =\= Europe.

> I think that's only expensive for companies who intend to to sell or otherwise do something shady with user data. Remember, not collecting data makes you instantly compliant with zero cost.

A lot of businesses need consumer data to improve their offerings and be competitive against the big boys. And RGPD lawyers ain't cheap, so even if you keep the minimal amount of data, you have to fork €10k+ to review everything, etc. The requirements for AI are even worse. All of those compliance jobs are unproductive and a burden on EU companies.

Same for the tax compliance obligations, which are ever increasing and now require you to record and document everything, especially if you do cross-border operations, as you are considered guilty by default if you don't.

We could also talk about the requirements to audit your sourcing chain for "human rights abuses", which ends in compliance hell for industrial companies with 2k+ suppliers, while of course Chinese companies don't have this problem.

The EU doesn't do any cost/benefit analysis on this, and just suppose that companies will magically find ressources to deal with their new regulatory "innovations".