Is this actually happening, though?

I feel most sites don't comply with the latter half of your statement (conditioning based on acceptance).

This is very true. Many sites and services seem to have deliberately misinterpreted the legal text. I hope a high profile target will be taken to court over this, to establish a cautionary precedent. It just hasn’t happened yet.

That sounds good. How is it enforced?

( not being sarcastic )

Every EU country has a data regulator. These regulators have a range of enforcement options at their disposal, from politely asking a company to comply up to a fine of €20m or 4% of global revenues.

You can see a list of previous enforcement action and adjudication decisions by the British Information Commissioner's Office at the link below. These are all under the old Data Protection Directive, which was broadly similar to GDPR but somewhat lacking in teeth. You'll see everything from a slap on the wrist to six-figure fines.

https://ico.org.uk/action-weve-taken/enforcement/

https://icosearch.ico.org.uk/s/search.html?collection=ico-me...

It’s not (yet). The GDPR is still new and as far as I know there haven’t been many (or perhaps not any) legal processes.