The consent flows are good enough that the companies selling them can claim that they're compliant, and enforcement is slow, partly because there are so many things that are not 100% clear.

The header would be a relatively clear cut situation, also opening the path to private enforcement via NOYB & Co.