Yes, but they have been already fined in the past and law enforcement is keeping an eye on them. This could be better of course, but keep in mind that the GDPR is still a new thing and enforcing it requires time.