- Overly-defensive company policies, which ask for consent "just in case"

- A bandwagon effect of "everyone else is doing it"

The first is quite understandable, and has been policy at every company I've worked for/with. One decided to remove all cookies rather than adding a consent popup; the only cookie we used was for "remember me" on login, so we changed the default to false and put a note next to the tick box. Every other company I've worked for/with has decided to add a popup instead; unsurprisingly, they were also setting a whole bunch of tracking and adware cookies.

The problems I have with the "bandwagon" are that (a) popups are more obvious and memorable than not having popups, which biases the bandwagon effect towards the obnoxious behaviour (availability heuristic); and (b) users seeing all these popups think they must be necessary, and misattribute their cause (e.g. thinking GDPR requires them, rather than companies either playing it safe or refusing to stop surveillance).

You can have as much design as you like.

Bloated website designs don't need tracking cookies, and tracking cookies are the only type that needs explicit consent.

Anything that's not required to provide users with the service they're after must either not track them or ask for explicit consent before doing so.