Business currently just state they comply with GDPR, but really they don't.

All these big blanket OK consent buttons we see on landing pages have already been shown in court do not constitute informed and freely given consent. The real impact has het to come, hopefully after some stiff fines are handed.

And you are right: I also wonder about enabling large scale VAT dodging by sites like aliexpress.