If GDPR were entirely toothless then they wouldn't have shown you the consent form but they would've just served the cookies regardless. The GDPR is not about reducing the cookies served, it's about letting people opt out.

Unfortunately it is lacking some teeth because normally opting out of all cookies should be as easy and straightforward as opting in to all cookies, but I've seen quite a few forms that hide 'reject all' behind a 'more info' button type of thing. Maybe I could file a complaint about that, I should look into it.

That means gdpr is working.