Until they come up with a procedure to workaround the fact that there is no majority in the EU parliament and push it through anyway (like they did a couple of weeks ago with ChatControl 1.0).
For example: there is no setting in Facebook Messenger where users can enable or disable Chat Control.
This is like saying that private prisons are voluntary because the corporations that run them were not forced into the market.
The EU never delegitimised itself more than it did with that act. Actively undermining parliament to knowingly impose legislation the population absolutely does not want validated every concern anti-EU advocates ever had.
To some extent countries are bound by EU law, but what this means depends on the institutions and legal structure within that country. Although the EU tends to claim they have final say, but how can someone interpreting national law agree with that if the EU goes against the law they are interpreting? Even if the EU is right they can only ask members to acoid contradiction, they lack the force to demand it.
It seems like its operating as a government too me, but maybe I am not seeing the whole picture.
The government could also do this for the EU, it's called leaving the EU.
And this makes a lot of sense with rules about food safety, product standards etc. It almost makes sense for privacy protections. It makes very little sense for surveillance laws.