Because most people haven't read GDPR or similar laws, and play it by the ear. Considering GDPR is often called the cookie law means people who dom't read the law, and don't hire lawyers end up doing things like this.

What is the EU going to do anyway? I've yet to see any meaningfull challenge from EU about GDPR.