There are already 2 text coming that significantly change it. Mostly to make it more protective. Search for "ePrivacy".

On top of that, there is a wide range given to the DPA which they are using. It is just that the EU agencies prefer to try to educate first before hitting companies hard, which makes sense.

In practice, if it had not been for Covid, the UK DPA would have killed multiple adtech company during the Summer. They had announced having planned it earlier this year.