They have actually fined several large tracking providers for their shady cookie popups because opting out was harder than opting in.

European DPAs aren't getting enough funding to take on this problem, but they haven't been sitting still either.

They're slowly working through the backlog. Even Google gave in and put a single, working "deny all tracking" button front and center.

Recently I've noticed more sites providing a visible "Deny All" button, rather than the dark pattern of going through and unchecking 5, 10, 50 tracking cookies individually, or having to dig out a button hidden somewhere.

I assume this was how it was intended to function, but the kind people that run internet websites intentionally made it more difficult.

Indeed, the bigger players were, I think, specifically contacted.

Lots of smaller players still do it, though, so maybe this is not the most effective enforcement style.