> What is the largest GDPR fine yet for a violation specifically about website consents?

I don’t think anything big. Which is a shame, because as long as that continues, the fake-compliance popups will continue.

> There seems to be companies selling blatantly noncompliant GDPR popup tech too

We are using one of those (Sourcepoint [0], we don’t pay for it though), they are very configurable, you can be as compliant or non-compliant as you want with their settings. They support all variations.

[0]: https://www.sourcepoint.com/

> What is the largest GDPR fine yet for a violation specifically about website consents?

200 million for British Airways according to https://www.enforcementtracker.com/

Different type than what OP asked for.

> The ICO’s investigation has found that a variety of information was compromised by poor security arrangements at the company, including log in, payment card, and travel booking details as well name and address information.

My bad, misread the reason. I looked for cookie and it seems to be 30k then to Vueling airlines:

> (...) for not giving users the ability to refuse their cookies and force them to use them if they want to browse its website. In other words, it was not possible to browse the Vueling page without accepting their cookies.

Nice find. There are 3 others related to cookies, seems only Spain is going after them so far and only after the violators who don’t even pretend to be compliant. I think some of those were already violating the GDPR’s predecessor.