The EU could have started fining everybody and unleash hell at unseen levels. They would have ended up bankrupting companies and people who added google analytics or AdWords to their site in good faith, without understanding the privacy implications.

So the regulators initially notified companies and gave them time to implement whatever change they were required to. To this day, if they aren’t satisfied with the changes, they contact the company again, they don’t just issue fines. This happened to a company I used to work for, that initially just added a cookie banner, then was asked to make the “deny all” and “accept all” buttons of equal size and with equal accessibility.