Dear Mark,
I'm entirely on the same page with you (I never mentioned cookie consent as an EasySocial feature, and I haven't started this topic).
I solely mentioned xenForo's "Right to erasure" compliance because I liked their implementation.
As I indicated EasySocial already can be made compliant as it is.
As for the mandatory Privacy Policy acceptance in case of intranets (for which we're using this and our other EasySocial licenses on other accounts here) not many other components are used.
These intra/extranets are in "lockdown mode" by ES, and we need to deal and save old and new users consent for Privacy Policies once and before they enter (I'm sure we're not alone with this)...obviously it can be done with almost anything quickly (a form component, a newsletter component or even ES custom fields), but a dedicated GDPR section for ES wouldn't be such a bad thing...
As in case of the now released WordPress and the upcoming J! 3.9/3.10 have at its core...albeit when it comes to J! I've tested the current dev/Privacy branch aka. "Privacy Framework repository"...there are so many sounder implementations; as always Joomla seriously in need of more developers....maybe ES can interact with J!'s implementation in the future if J! can grant more resources towards their Privacy Framework)
The US Senate now also works on a similar approach (although they nowhere near yet..and it's not in their best interest anyway). Each day there'll be fewer countries to where Facebook can transfer 1.5 billion user accounts repeatedly.