The jurisdiction is EU (GDPR is binding legislation for all member countries, not dissimilar to US federal law), and the enforcer is primarily the country where

The jurisdiction is EU (GDPR is binding legislation for all member countries, not dissimilar to US federal law), and the enforcer is primarily the country where the company that owns the website has European incorporation. In theory anybody can report to their country's data protection officer, although at least in Finland they don't care about individual citizen complaints. The NGO noyb is sending out batches of these reports. They have some minor wins, but as you can probably tell from all these nags around, by and large there's not much effect. All these questions are sorted, on paper. https://techcrunch.com/2022/08/08/noyb-gdpr-cookie-consent-complaints/ https://techcrunch.com/2022/08/08/noyb-gdpr-cookie-consent-c...