There are exemptions for academic research and journalism in the GDPR under article 85 [0]. That is why the original news article (that I wrote) clearly mentions right away that the information was collected for a academic project.
I don't think that many stores track customers and that a lot of the hype from a couple of years ago never ended up in a successful commercialization of the technology.
More background: The fine is mainly based on the fact that Disqus forgot to enroll Norwegian IP-addresses into their GDPR «privacy mode».
That meant that websites that had enabled a specific setting ("Enable anonymous cookie targeting") in Disqus were tracking Norwegian without informing them. Most of the websites in Norway and elsewhere did not know they were sharing users data through Disqus.
Major sites like the Wirecutter, The Hill, 9to5mac, Breitbart had enabled the setting in 2019. Of the 23 websites I contacted, all 11 that responded told me they were unaware of the tracking and had turned the setting off.
(I wrote the investigative articles in 2019 for the Norwegian public broadcaster NRK.)
There are some nuisances on jurisdiction, but if a company tracks users in Europe they may fall under the purview of European data protection authorities.
There are several factors that play in. For example that the data controller offers the delivery of goods in EU Member States, say a plugin like Disqus. It could also be that they have a .eu top level domain.
The Norwegian DPA also writes this in their advanced notice: "Online tracking using cookies and behavioural advertising are explicitly mentioned as activities which constitute monitoring of behaviour in the EDPB Guidelines on the territorial scope of the GDPR."
We part of the European Economic Area (EEA) which is quite close to being a EU member, but without voting rights. Norway voted two times on membership and the compromise was EEA.
Disqus does not track users from GDPR countries by default. My initial story in December 2019 for the Norwegian broadcaster NRK was a result of Disqus not knowing Norway had the GDPR (we are part of EEA, but not EU).
Users are checked based on IP whether they come from a GDPR country. If GDPR, they will be put in private mode. A user needs to create a profile and consent to sharing for tracking to begin.
Norwegian DPA opened an investigation as a result of our stories and Norwegians are now in private mode by default.
[0] https://bookdown.org/fede_caruso/bookdown/the-journalistic-e...