As the EU strengthens its digital laws, it is time to take stock of what works and what doesn’t in the existing framework of data protection law. The effectiveness of data protection law can be measured in two ways. First, by looking at the efficacy of legal procedures and sanctions on illegal behaviour. In the data protection directive of 1995, both these aspects were unsatisfactory. The GDPR brought improvements through several complaint mechanisms and by reinforcing the cooperation between data protection authorities. However, this raised new issues – amicable settlements, hierarchisation of procedures and international cooperation – demonstrating the need to delineate these procedures in detail. The effectivity of the GDPR can also be measured quantitatively, through, for example, advertising cookies. Overall, although the GDPR seems to have strengthened the “notice and consent” procedure, studies show that controllers often use dark patterns and opaque practices to keep collecting cookies without the consent of the data subject.