Carrefour got a spicy +3M€ fine in November 2020.

You can find a non-exhaustive list here (FR) > https://www.nextinpact.com/recherche;q=cnil%20amende

Also, GDPR applies as long as the company runs a business in EU. It doesn't matter where the company is originally from. They will be more than happy to fine the french entity if it made sens. Instead, they fine the Irish entity that performs social dumping. Not bad.

Carrefour has revenue of 80bn/year (Google has 68bn/year in Europe).

Very spicy indeed.

"The complainants argued that Carrefour (1) did not comply with their data access or erasure requests; (2) sent them direct marketing communications despite the fact that the complainants had objected to receiving those communications; or (3) in one case, did not allow the complainant to unsubscribe to marketing emails."

This all seems a lot worse to me than making one button harder to press than the other.