All you need is to build this in to devices sold in EU - iOS, Android, Windows...Each give you privacy controls at the OS layer that applications must respect, on the browser level, this may be a "reject tracking and cookies". Boom. Done. All EU websites will be required to check for this API and their JS code must be plain to see for any visitor using the "view source" option. Going forward, we can build privacy controls at the technical layer, so regardless of the'stack'/'layer' software and hardware is built with GDPR in mind. We are still a long, long way away from that reality and truthfully, we will likely not be there for many decades.
Sadly, it seems this "cookie" debacle is one that is more society based than technical, and it's obvious cookies should probably be replaced by now with better solutions.
Maybe the GDPR might finally yield some positive changes but I remain doubtful. The industries it wants to disrupt have powerful lobbyists (hence why most right to repair legislation doesn't dare challenge Apple, for example).