They literally are. If a consent form has an “allow all” button but no “reject all”, as many do, then it is not compliant. Likewise for “legitimate interest” (that one really gets my hackles up: it basically says “we see your preference, what would you think if we didn't give a crap?”).

There have been some fines related to this sort of thing, and over time some of the dark patterns are getting a little less common, but enforcement thus far has not been sufficient to make the less dark variants the norm.

They are. Enforcement is on the way, just slow. Belgium just charged the IAB Europe group a big fine.

The dark pattern is that the government can order people what to put on their Web site.