The problem is mostly in the enforcement. Most GDPR pop-ups do not actually comply with GDPR. And they only exist because companies wish to weasel out of stopping doing what the regulation is trying to stop them doing, and the lack of enforcement means they get away with it long enough people who don't have a clue just cargo-cult what the weasels are doing.