The regulators who are supposed to enforce the GDPR are either incompetent or unwilling to do so. I suspect there might be political problems with stepping up enforcement considering a lot of politicians rely on social media & ads (which is powered by non-consensual data processing) to help with their (re)-election.