Also there are a lot of websites not meeting GDPR rules but major sites do even if it is block all visitors from Europe - cookie consent rules are also broken by many but that is an different law.

Usual problem with laws who enforces them.