The Sheet #16 about cookies and third-party trackers is quite interesting:

    ## To benefit from the exemption from consent
    
    **Subject to a number of conditions**, cookies used for audience measurement are exempt from consent.
    **These conditions, as specified in the [guidelines on cookies and other trackers](https://www.cnil.fr/en/cookies-and-other-tracking-devices-cnil-publishes-new-guidelines), are**:
        * To inform users of their use;
        * To give them the ability to object to their use;
        * To limit to the following purposes only:
            * audience measurement;
            * A/B testing;
        * Not to cross-check the data processed with other processing (customer files, statistics on visits to other sites, etc.);
        * To limit the scope of the tracer to a single site or application editor;
        * To truncate the last byte of the IP address;
        * To limit the lifetime of the trackers to 13 months.
    
    Provided that the conditions are met, **we therefore switch from an opt-in to an opt-out regime**.
    It is also possible for the same third party (subcontractor) to provide a comparative audience measurement service to multiple publishers, provided that **the data is collected, processed and stored independently for each publisher and that the trackers are independent of each other**.
    
    ## In practice
    
    **Most large audience measurement offerings do not fall within the scope of the exemption, regardless of their configuration**.

That's what I though, when websites welcomes you with a giant popup "Manage your consent" with a gazillion third-party trackers all opt-in (and you need to disable them one by one) they are actually not GDPR-compliant.