The EU’s General Data Protection Regulation (GDPR) seeks to guarantee people’s fundamental right to the protection of their personal data in an effective way. However, the disparity, complexity, imbalance between parties and inefficiency of some national legal procedures is making it very hard for consumers, and the organisations defending them, to exercise their rights under the GDPR in an effective way and get companies to comply with the law. This is leaving consumers exposed to Big Tech companies that are profiting from exploiting people’s personal data all across Europe.