It would be time-consuming and expensive to take some of these companies to court, and likely difficult to win as they'd nitpick over fine details and pass the buck over who's responsible.
Slowly turn the wheels of justice. We’ll get there, I think. Lawsuits take time. Regulations take time. And, as demonstrated in every GDPR-discussion anywhere: understanding takes time.