Good law doesn't "let companies opt-out;" it is crafted with consideration for what is already happening and the consequences of the law.
it doesn't appear, 2 years in, GDPR passes that test. If the goal was to minimize "privacy violation" by FB and Google, it's failing. FB and Google are stronger than ever, but their competitors are starved out of the market trying to comply with an onerous suite of policies.
It's such a ladder-pulling set of laws it's surprising Google and Facebook didn't craft it.