Comment by redwall_hp

The GDPR does. Consent to data processing must be unambiguous, accessible, informed in plain language with no legal or technical jargon, and not have any preselected boxes.

https://gdpr.eu/gdpr-consent-requirements/

The problem is the capacity to litigate is far surpassed by the world's speed and volume of doing bad.

This is a case where companies' actions should be treated like parking tickets: a fine is issued summarily, with option to appeal, not a slow process of litigation having to happen before a fine is issued.