Most European countries, have their own version of consumer protection agencies, usually any kind of complaint gets sorted out, even if takes a couple months.
If they fail for whatever reason, there is still the top European one.
Most of the time I read about FTC, it appears to side with the wrong guys.
Once again. The full consumer protection would be banning behavior-based advertisement completely, which I would welcome. GDPR is striking a balance. It forces the companies to ask if they are going to collect data and use it in any other purpose from delivering the information / service.
Almost all of the web is feeding data into Google's ad and statistics services which are used to profile people and completely out of scope. That's the minimum. Worser services feed your data into every single PII broker. If you don't collect such data, no banners are necessary. If you need an address and an email to just ship a product, you need 0 cookie banners. The websites can also do geo-fencing so you don't see any banners. They don't want to spend any money to engineers though.
But no, it is EU's fault to create a balanced law. Companies should be violating you and your pricacy left and right. That's their right, isn't it.
And it accomplishes that goal. A lot of people on this forum are quite unhappy about it, but that's not because it's an unforeseen consequence.