In my experience with the GDPR it's selectively enforced on large companies and not small mom and pop shops unless they are handling unusually sensitive data. The legal system can only handle a couple of cases at a time, spending that on small shops with inconsequential signal effects isn't their MO.