GDPR General Data Protection Regulation
The EU's data protection regulation from 2018 — strong, with steep penalties (4% of global revenue).
Core principles: consent, data minimisation, right to be forgotten, breach notice within 72 hours. Applies to anyone handling EU citizen data, even companies outside the EU. Cookie popups are (partly) GDPR's fault.