Or usability of this feature would be so frustrating, that no one will use. Constant security popups on every start, very limited available API for apps, etc...
European DPAs aren't getting enough funding to take on this problem, but they haven't been sitting still either.
I assume this was how it was intended to function, but the kind people that run internet websites intentionally made it more difficult.
Lots of smaller players still do it, though, so maybe this is not the most effective enforcement style.