I believe you are missing the point of the comment.
Even if smaller players take all super duper steps to protect user data, advertisers have no real way of knowing if they are in fact compliant whereas they have a simple way of looking at the published balance sheets of the big players and seeing the huge cash pile and armies of lawyers. The scare caused by activists weilding "nightmare letters" doesn't help. Also there's a body of thought in legal circles that even vendor chains needs to be evaluated which is causing advertisers to be wary. Far simpler to just throw money at the biggies who will deal with this.
As usual, the smart money will be in the certification industry that will inevitably come up to tax the mid sized players while the small publishers will die out.
I think the basis of GP's comment is the bias a lot of GDPR supporters - myself included - have: we'd like to see the entire advertising industry die. So even if the effects hit smaller publishers more than the large ones, as long as it causes enough damage to the whole business model and incentivizes people to look for alternatives, it's a step in the right direction.
> even if the effects hit smaller publishers more than the large ones, as long as it causes enough damage to the whole business model and incentivizes people to look for alternatives, it's a step in the right direction
Remember the adage “divide and conquer”? If you want to destroy something, consolidating its power base (like GDPR does to advertising in Europe) is a poor first move.
> we'd like to see the entire advertising industry die
The GDPR doesn't only apply to advertising companies. When you're offering services in exchange for money you still have your customers' names, IP addresses etc. Even if you aren't using any of that information for advertising or data mining, you still have it, which means you still have the compliance cost. A lot of that cost is not proportional to how much data you have or what you do with it.
And that's the problem. The GDPR will never destroy Google or Facebook, but it can destroy a three person startup that has nothing to do with advertising and might have offered an ad-free alternative to some of their services.
If destroying the ad industry is the goal, why not just tax advertising at >90%?
Problem is, those players will still incur the compliance costs. The GDPR rules are not simply penalties for bad behavior. They mandate proscriptive actions companies must take, policies they need to design, services they must perform on demand, etc. whether the company is engaging in bad behavior or not.
Even if smaller players take all super duper steps to protect user data, advertisers have no real way of knowing if they are in fact compliant whereas they have a simple way of looking at the published balance sheets of the big players and seeing the huge cash pile and armies of lawyers. The scare caused by activists weilding "nightmare letters" doesn't help. Also there's a body of thought in legal circles that even vendor chains needs to be evaluated which is causing advertisers to be wary. Far simpler to just throw money at the biggies who will deal with this.
As usual, the smart money will be in the certification industry that will inevitably come up to tax the mid sized players while the small publishers will die out.