This past May, the European Union’s General Data Protection Regulation (GDPR) went into effect. The comprehensive regulations shift the dominant paradigm of online data from an opt-out model, in which users had to take action to control their data, to a privacy by design model where privacy and user control must be up-front and center.