TlDr; GDPR isn't to blame, GDPR is to blame. GDPR doesn't require them but an existing law does and GDPR is causing companies to notice.