> consent pop-ups being found to violate the GDPR
Consent pop-ups as a whole haven't been found to violate the GDPR. Specific patterns that certain consent pop-ups implement were determined to be in violation.
> My understanding is that the cookie set by the consent pop-ups may now be classified as personal data
I have re-read the press release and I don't see that anywhere. A cookie saying consent=true is absolutely not personal data. The problem is that personal data was being collected without proper consent (the pop-up that was supposed to obtain the consent does not comply with the regulation).
> politically somehow cookies have become the big privacy boogeyman
This is partly a holdover from the previous ePrivacy Directive which very much focused on cookies. Consent management solutions (both compliant and non-compliant) were designed to address that. These consent management solutions are now being repurposed to comply with the GDPR and some may not have adjusted their wording and still incorrectly focus on cookies even though the GDPR covers data collection & processing regardless of the technical means of doing so (so it's no longer specific to cookies - you can perfectly breach the GDPR without setting a single cookie).
> Meanwhile personal data is harvested at HUGE scale (cable TV / smart TV/ ISPs etc)
This is something that the GDPR addresses. Unfortunately enforcement has been severely lacking.
> the EU says ads and analytics are not essential
Ads aren't technically forbidden. Non-consensual data collection for targeting is. You are still allowed to serve ads as long as they aren't targeted based on the user's personal data (you can still target based on the currently viewed page's content for example).
Analytics are frankly not essential - you don't lose anything if only 10% of people opt-in for example. But even then, it is absolutely possible to implement analytics in a privacy-respecting way without relying on any personal data (and thus not require consent); for example a single hit counter that just increments an integer every time a button is clicked should not require consent. You'll only need consent if you tie that analytics event to a persistent user session.
> since for free websites they are in reality pretty essential
This is due to a lack of proper enforcement of the GDPR. At the moment the big players violate the GDPR, so any site that decides to respect it will lose out. If the GDPR was enforced and everyone was complying, the playing field will level out and either ad prices for non-targeted ads will go up (as very few people opt into ads, so this leaves a lot of inventory on the table that advertisers will suddenly want to capture) or services will start to ask for payments, normalizing non-ad-supported services.
> I am bummed about SSO issues now
That's a problem because the lack of (enforced) legislation around cookies made browsers delete them aggressively. It would've been better if legislation such as the GDPR was enacted (and enforced) sooner so that abuse of cookies could've been dealt with legally, leaving the concept of cookies itself as-is so it can still be used legitimately.
> modal cookie popups particularly on mobile
That's again due to the lack of enforcement. A proper consent flow should allow you to easily decline all cookies, or even better, just not be there in the first place because the website doesn't have to collect & process any personal data for non-essential purposes (just FYI, cookies essential to the functionality of the website don't require consent - a session cookie on login or for a shopping cart does not need consent).
> The other issue privacy folks are missing I think is focusing on this endless consent and reconsent on every website.
Again see above. Most of the annoying consent flows aren't actually compliant. The reason they're there and are annoying is to trick you into clicking accept (and to hate on the GDPR). Hopefully this ruling will force them to comply with the law which says that it should be as easy to decline as it is to accept.
> I've seen data that 95%+ of folks click accept all
See previous paragraph. That's the intention behind these non-compliant consent flows. If it's too difficult to decline then people will click accept all. On the other hand, when the flow is implemented properly such as Apple's App Tracking Transparency flow (which gives you a system-generated modal that allows you to accept or decline in one-click), the opt-in rate is in the single-digit percentages.
> in long run this compliance overhead will help the mega platforms win out
I am not sure. They are (well, were) currently winning because they are big enough to risk it, but the tide is turning with rulings such as this one. Facebook is in big trouble for example because their business model (which relies on mandatory, large-scale data collection) is at odds with the GDPR and they are trying to legalese their way out of it, unsuccessfully: https://noyb.eu/en/austrian-supreme-court-facebook-dismissed
> if you are going to put a video online, you are going to need to put it on youtube if you want anything analytic related to it
If you put a video online you can easily count the number of views by just analyzing server logs. What you can't do (and Google can't either) is track users to determine unique views for example (as that would require assigning each user a persistent ID).