[M2Ys4U]

>These twenty page privacy policies that I agree to with a flick of the scrollbar and a button click, or these equally boring popovers when I visit a site, are where the governmental innovation needs to happen next.

If the sites are relying on consent as their legal basis for processing personal data then hiding it in those policies is 100% a violation of the GDPR.

Enforcement action is unlikely to make headlines, though as it'd be such an open-and-shut case it won't even make a courtroom. The supervisory authorities will just impose administrative fines.