And the fines need to be stiff, like $10,000 per incident per user. It's gotta hurt or companies won't stop doing it.
Is this what you believe happened with Wacom in this case? How could these tracking points be converted into revenue?
Personally I think this was a good case of "Any sufficiently advanced incompetence is indistinguishable from malice", but maybe my imagination is just insufficient.
Contrary to what many, both companies and individuals, seem to think, GDPR is not about cookie pop-ups but about regulating collection, storage and use of personal data.
It seems the real problem is consent… There should be a “nutrition facts” for software that is enforced at the OS level through an aggressive permissions model and backed by a privately run app stores subject to audit by government regulators.