Yeah, it's a requirement by law, tracking must be disabled unless explicitly allowed. Accepting all must be as easy as denying. However a lot of sites offer an easy one-click accept all and the deny all is behind a two step "configure" + "confirm selection", sometimes even with a fake save timer.