It's not legal, but they probably do so anyway.

I use uBlock Origin to delete the GDPR banner, clicking neither "accept" nor "reject". I just hide it. I have no idea whether this makes any legal difference, and I am sure the assholes responsible don't care either way, but it makes me feel better to circumvent the silliness.

Some do some don't.

The GDPR strictly requires an explicit opt-in. So it's reasonable to assume that clicking on 'X' is a rejection. But some website do not accept that as a rejection.