GDPR fines are up to 10 Million Euros or 2% of total global revenue, whichever is higher. Maybe an EU citizen should sue them, since that behavior is listed as a dark pattern in the guidance.

Anyone can report them for investigation. I forget what the contact email address is but I had to add it to my GDPR compliance page so I know it exists.