In practice, nobody is going to enforce this, so they're in the clear. 90% of the cookie consent flows you see out there are not compliant either and are little more than compliance theatre.