That's true, but more often than not, the benefits that, say Facebook, gains from violating gdpr outweigh the fines they have to pay. Otherwise they would have stopped doing it after the first such fine, yet they keep doing it. Clearly it's paying off.