There's only so much they can do without being called out for retaining state in "private mode." It's true that GDPR allows them to store a cookie to indicate that the user declined cookies, but private mode is something else.

What kills me is that when I hit the button to go fullscreen in YouTube, the first thing that happens after the transition to fullscreen is a carousel-like overlay of other "related" videos. Uh, OK, Google, why do you think I hit the fullscreen button, anyway? Because I want to watch this one.

The monkeys are running the zoo over there.