"Incognito" mode (or whatever one's browser may call it) is irrelevant in this scenario."
No it is not. When looking at what a website does, if you browse in your regular session you may be bringing over a very large cookie store, visit history, prior acceptance of cookie popups. The reason I suggest using a new incognito session is because you start these sessions fresh from a cookie perspective, and the site you are visiting should see you as a new user and re-prompt for cookie acceptance etc. Then you can easily see what they are doing.
It's really actually interesting being lectured and yelled at by "experts" here. I think the GDPR is sort of a bandwagon thing at this point. A fair number of relatively uninformed folks on the issues / technical side jumping on and making a set of fairly strong and often uninformed claims?
You literally have folks saying GDPR is not complicated, and literally on the same threads making plenty of contradicotry claims (ie, totally illegal to not have a deny all button, totally banned to track before acceptance, ok to track before acceptance (default opt-in vs opt-out) etc.
The folks claiming GDPR is easy don't realize how big a consulting industry has sprung up to try and help folks trying to get it right. I mean, tracking rules for the cookie acceptance cookies - is like perfectly up these consultants thing because they make so much money off all this.