The GDPR somehow had the power to make (almost) everyone comply with it, even outside of the EU. If only they had specified that instead of banners, companies had to actually respect the Do Not Track header, even if set by default on a browser, and everything that could be rejected would be rejected if that were sent.