This is absolutely not my experience while working in an Ad agency in EU. There are companies like Iubenda which basically handle all the normative side of thin

This is absolutely not my experience while working in an Ad agency in EU. There are companies like Iubenda which basically handle all the normative side of things, and if required by third parties they also do the compliance checks. We've had no more than two disputes since the GDPR was passed and they both ended up with a simple "Please remove their data and make sure that X services are deactivated too when the user fills their consent form". No scary lawyers or multimillionaire suits. I guess that part is reserved for those that consciously decide to ignore the rules.