The GDPR introduced restrictive privacy-preserving measures, affecting the daily life of (online) consumers. Moreover, literature shows that privacy preferences are constantly evolving. This is the first study introducing a GDPR exercising-oriented approach to identify consumer privacy types. Based on a representative sample of the German online population, we cluster consumers according to their privacy importance (“intention to act”) and GDPR knowledge (“ability to act”) and derive four consumer privacy type clusters: fundamentalists, amateurs, pragmatists, and unconcerned. We investigate motivational factors for changing privacy settings and find significant differences between consumers’ intentions and actions for selected factors. This provides evidence for the privacy paradox. Contrarily, intentions and actions align for other factors, which supports the hypothesis that action-based consent might lower the privacy paradox. Finally, we suggest the development of standardized scales and corresponding clustering methodologies for consumer privacy type clustering to increase comparability over time and across populations.