Also, GDPR compliance is forcing companies to collect and store data they wouldn't have been collecting otherwise, such as to be compliant in regards to child safety you must find out which users are children. Data itself can be seen as a somewhat radioactive commodity, requiring exquisite handling, and creating new reputational and security risks.

It's not supprising that many smaller companies are saying fuck this noise.