GDPR is pretty recent (2018) and legal opinions on how to apply it (e.g. marketing tracking) are still in the making. I think fines are still applied "slowly" so that the industry has time to change.

Constantly applying fines is not sustainable. You eventually want to get to the point where privacy "just happens".