GDPR hasn't been really enforced. I don't think anyone is scared of GDPR anymore.
https://www.spiegel.de/netzwelt/web/mastercard-zahlt-kunden-...
I'm aware of a single record case that cost the perp 350K. You really don't want to get zapped with the maximum fines based on wilful transgressions on large numbers of people.
edit: I misremembered, it was 100K higher.
Somehow that doesn't stop the proliferation of tracking across the web's largest properties and companies.