> Enforcement of GDPR is a sad joke.

There are millions of websites that serve EU customers/users. Enforcing GDPR through the courts is expensive, because courts are expensive.

So GDPR enforcement amounts to making an example of prominent offenders, where the case is cut-and-dried. But before taking enforcement measures, the authorities will notify the offender, in the hope they will come into compliance voluntarily.

Honestly, I think cajoling people into compliance with the law is a better enforcement model than the "drag em into court, then fine the hell out of them" model, when the number of offenders vastly exceeds the legal capacity of the enforcement authorities.