Here in Japan the government cracks down on it hard. There are fines for every n users exposed and in extreme cases a company can be forced to stop trading for a period of days or weeks. Companies are so scared of this happening to them that a significant portion of orientation for new employees is spent on it. I don't have stats on how effective it is, but I do know that the public is less willing to accept it as they tend to elsewhere.

GDPR has fines:

Up to EUR 10,000,000 or up to 2% of the total worldwide annual turnover of the preceding financial year, whichever is higher; applies to infringements such as controller and processor obligations, security of processing, record-keeping, and breach notification duties.

Up to EUR 20,000,000 or up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher; applies to infringements of basic principles for processing, data subjects’ rights, and unlawful transfers of personal data to third countries or international organisations.

>When you sign up with just a random 32-char string...

There's STILL a browser fingerprint, IP logs to analyze, usage patterns to build a profile from. You may claim you don't collect it, but users need to take your word for it. This is just pseudonymity, which (as many BTC users found out) only gets you halfway there. Real anonymity is way harder, often impossible.

Don't get me wrong, it's good to see organisations that care about privacy and in fact this blog post encouraged me to consider your services in the future. We have some use cases for that at work.

Though by using cloudflare you're NOT putting your money where your mouth is.