It was enforceable before too, thanks to the Data Protection Directive from 1995. GDPR is an harmonization of the various national transcriptions of the DPD, plus higher fines, a better cooperation mechanism, and data portability (which is a bit useless but it's nice to have). Cookie banners also predate GDPR (it was the ePrivacy directive).