Sadly, the EU is also lax when it comes to enforcing regulations. See GDPR.

GDPR enforcement belongs to individual country information commissioners, unfortunately.

The EU is not as federal as the US and has basically no "federales" law enforcement of its own.

The EU is in effect much closer to a confederation than a federation. A lot of the problematic aspects of how the EU is set up are attempts to work around the limitations imposed by not having sufficient public support to reform it into a more federal structure. To some that's a feature, of course, to others it's a significant nuisance.

And the practical effect of this is you get a race to the bottom: countries compete on how lax they are going to be in enforcing GDPR so as to attract American tech companies.

The Data Protection Commission in Ireland are remarkably lax about enforcing it because the government quite likes the tax revenue that Google, Apple and Meta brings them.

It's not a race to the bottom any more than competition lowering consumer prices is a race to the bottom. It's one of the few checks on governments just demanding more and more tax money for little return.

No as much lax as lacking resources to deal with widespread violations. They probably focus on the most egregious cases.

Isn't GDPR a directive as well?

No, the clue is in the name, "General Data Protection Regulation". If it were a directive, it would be called GDPD.