This has been driving me nuts. So what's going on is bad actors just continue to violate the GDPR but throw up cookie banners purely as a formality? I suppose

This has been driving me nuts. So what's going on is bad actors just continue to violate the GDPR but throw up cookie banners purely as a formality? I suppose this raises the question how will California enforce this?