One Year In: Three Lessons Marketers Have Learned About the GDPR