Well, GDPR went large steps in making it somewhat illegal, while users may still "consent" to being tracked ... which lead to big cookie banners nobody understands. Steps are being done, but lobbies are strong in their fight against.
That's the problem, in my opinion. Users should not be able to consent to third party tracking because if they can, companies will use any dark pattern at their disposal to make them consent. Third party tracking in general should be banned.
That's good progress.
However I agree to you that this isn't enough. Even without dark patterns too many people will click "yes" without understanding and this will live on in some way or another, till we make laws stricter.