A while back, I added a comment to a similar article "Fork it! Google fined €4.34bn over Android, has 90 days to behave". I'll repeat it here because I believe it to be applicable in this case, too:
"I may be missing something here, but what, in practical terms, could the Competition Commission do if Google said 'No'. Not going to argue… not going to appeal... just 'No, not going to pay'."
(and this time I'll add: "or just ignore the situation - don't even bother to respond")
Change "Competition Commission" to "GDPR" (or whatever the authority's name is) and "Google" to "Facebook", and the same question holds.
Yes, I can already hear people proposing responses to such an event along the lines of "shutting the gate" on Facebook - requiring all ISPS to block them, etc. Well, we all know that such a restriction would last, oh, thirty seconds or so, give-or-take 25, before someone developed a workaround and published it.
Don't get me wrong - I fully agree with almost everyone here, that Facebook, Google, etc should not be collecting data on me and selling it on or otherwise making use of it **unless I say it is OK to do so** (and they would have to work extremely hard to make me say that).