The GDPR so far doesn't have any enforcement for stuff like this. All the links to "enforcement tracker" (which I'm sure someone will reply with down below) have been either about a technicality like a badly worded privacy policy or the amount of the fine was peanuts compared to the size of the offending company.