It's worth noting that both VATMOSS and the cookie law have been substantially overhauled and reformed for the better thanks to positive, evidence-based, and cooperative engagement from the public and from organised advocacy groups.

So that's the nice thing about the GDPR compliance project: it has drawn people following those examples who want to be positive, constructive, and engaged, and just get on with the task ahead. Another lesson learnt from the previously mentioned issues is the importance of getting it right in good time rather than scrambling to retrofit fixes after the compliance deadline has passed, and that's what we're working on now.

People who want to spin political grievances, victim narratives, and conspiracy theories are entitled to their opinions but at the end of the day, as Jeff said, this work is about raising the standards by which we protect the people in our data, ensuring that the WordPress project itself is one that people can trust, and providing the tools that everyday site administrators need to be able to protect their users and themselves too. I can't think of any effort more worthwhile than that.