The GDPR is not being enforced seriously. There are plenty of violations already out there (including from big companies such as Google or Facebook) and nothing serious is being done about it.