The trouble with the GDPR seems to be that it relies on government enforcement.
For example the UK's enforcement arm, the ICO, recently found that the adtech industry was in violation of the GDPR, then did nothing:
https://www.openrightsgroup.org/blog/the-ico-must-fix-the-ad...
As far as I know, I can't personally sue these companies for this, and if the ICO does nothing then what's the law is meaningless.
The follow up from the Open Rights Group is here:
https://www.openrightsgroup.org/blog/parliament-must-hold-th...
If you care about privacy in the UK, please donate to ORG, I started a direct debit years ago and have always been impressed with their work and focus: