You are not wrong, but the fact that they never follow up and allow the practice makes them complicit. Same for the farcical malicious (non-)compliance of the GFPR through 'legitimate intetest' abuse.

What are they supposed to do about it?

They didn't want user data to be sent to third-parties without consent, so they created a law that made it mandatory for web pages to ask for consent to send the data. Most web pages need to send data to third-parties to be profitable, so they need to ask for consent.

What would the next steps be like? The purpose of the law is to give users the power to consent or not consent. In other words, I can pay for the contents of a web page with my data. Removing that option from me doesn't give me power to do whatever I want with my data: it takes that power away from me instead. That would be bad.