They aren't forced, they choose to. They're forced to get user permission before tracking them across websites and sharing info with 3rd parties, but how they do it is left up to the industry. And the industry chose dark patterns, hoping to annoy the users into complaining to the EU about them.
It is the fault of the EU. If you leave a steak on the floor you don't punish the dog for eating it. Site operators just chose to do what was most convenient for them within the boundaries of the law, as would you.
