I've dealt with them on multiple occasions, and either the strict enforcement is very different based on state, or it is as you say: if a small company sends an

I've dealt with them on multiple occasions, and either the strict enforcement is very different based on state, or it is as you say: if a small company sends an email to two people and doesn't use BCC, they'll be hunted down, but if a huge media company uses tracking beacons of non-EU-3rd-party adtech companies without disclosure or opt-in, they'll ignore it (source: reported literally this as well. They've chosen not to enforce the law, but instead asked the media companies how they'd like to go about this in the future. This affects millions of people per day.) It's a mess, and it works like an hallucinated moat. If you obey the law, you have a strong disadvantage. If you don't obey the law, you have a strong advantage, and nothing will happen to you. Non-enforcement trains people to not honor the law, because they can't compete if they do.