[jacquesm]

The GDPR absolutely has the capability to provide that motivation. Especially when you get hit several times for different instances of the same infraction it can really add up, potentially even a large player could be put out of business. I think that at some point in time one of these regulators is going to get angry enough that they may want to set an example.

[MaxBarraclough]

If the cookie law is anything to go by, the real question is enforcement rather than the letter of the law.

The cookie law is quite well written and makes it clear that the obvious dark patterns are verboten. You aren't allowed to use intentionally deceptive toggles, or to make it much harder to say no than to say yes. The law is very rarely enforced though, so such dark patterns are rife.

I suspect something similar may happen with other Internet-governing regulation.