The fact that companies can simply continue what they have always been doing “but with pop ups” is evidence that the GDPR did not go far enough.

Also, still waiting for the first major company-wrecking GDPR fine everyone was losing their minds over... any day now. There are doubtless plenty of companies still in violation.