Sure, there's the rules as written, and there's the actual behaviour of companies, and I think it's clear there's still a need for fines (and more of them) until companies start to comply and stop coming up with wishful workarounds to opt users in by default and then complain the law is unclear when they get smacked for an action that was clearly against the spirit of the law.