Punishing anti-competitive measures doesn't have to be always complicated.
"Allow cookies" modals are horrible but GDPR gives people in the EU rights to be forgotten and not contacted in the future. Reminding companies about GDPR regulations works very well.