To me, a privacy regulation that focuses not on merely collecting and protecting private data (HIPAA and friends), but instead on purposes of its use is very much a new model. For example, Amazon doesn't need consent to process and store your home address, but only as long as they use it to deliver goods you order and nothing else.

I think it's more of a problem with companies who are fighting to keep the old model (thus, asking for consent where it's not needed just in case they want to do something privacy-disrespectful with it in the future – you can totally deny consent and keep using the service) and consumers not understanding this (and thus, not voting with their feet). But I see GDPR enforcement every day (I donate to https://noyb.eu/en and recommend you to do the same if possible), people fighting non-free consent etc. – I expect in a few more years the landscape will be better understood.