That's because the sites currently have an option (or think that they have an option) to make tracking mandatory for their visitors, so long as they consent - which is the easiest way for them to deal with it. It sounds like this Dutch agency is saying that it is not actually compliant with GDPR.