> I believe there is also a lot of "cargo culting" where site admins copy what everyone else is doing without understanding the legal background.

And an entire industry with companies like TrustArc built on pitching and selling this crap even if not required and/or if their solution wouldn't achieve compliance anyway.