I know a lot of companies that I believe are compliant, but they also do not do anything where they'd need to process data with non-obvious reasons.

Many high-profile sites rely on advertising, and that makes things more complicated, since they have a clear business interest to get and share as much data as possible, instead of a "process only data strictly needed" approach others can take.