The GDPR is very clear (despite those who profit from breaching it would like you to believe): consent for non-essential data collection/processing should be strictly opt-in. You can't opt-in by default, you can't use dark patterns to trick people to opt-in, and you can't degrade the experience to coerce people to opt in.

Yet by your own comment's admission, Facebook has tried multiple blatant breaches of the regulation, and is still in business and trying their latest iteration of pseudo-compliance, which means whatever enforcement there is, it's clearly not enough.

When it comes to the DMA, Apple is currently on track to receive a (very low) fine for not actually complying by still preventing developer from letting users know they can pay for apps/services outside the App Store for cheaper. So clearly the potential penalties and actual enforcement is low enough that Apple is (rightly) calling their bluff.