Or usability of this feature would be so frustrating, that no one will use. Constant security popups on every start, very limited available API for apps, etc...

That would just give them a huge fine.

There is law and there is the spirit of the law. The ECJ can be pretty fast when they feel someone is taking the piss.

The cookie popups can be very annoying and confusing and they didn't do anything about that.

They have actually fined several large tracking providers for their shady cookie popups because opting out was harder than opting in.

European DPAs aren't getting enough funding to take on this problem, but they haven't been sitting still either.

They're slowly working through the backlog. Even Google gave in and put a single, working "deny all tracking" button front and center.

Recently I've noticed more sites providing a visible "Deny All" button, rather than the dark pattern of going through and unchecking 5, 10, 50 tracking cookies individually, or having to dig out a button hidden somewhere.

I assume this was how it was intended to function, but the kind people that run internet websites intentionally made it more difficult.

Indeed, the bigger players were, I think, specifically contacted.

Lots of smaller players still do it, though, so maybe this is not the most effective enforcement style.

That's why Windows is beautiful, all APIs are open for developers to use for whatever they want.