The popups happen because that turns out to be what the legislation is incentivising. The solution is to make different legislation that doesn't incentivise popups.

Some examples (obviously not problem-free, but just to show that a solution space exists):

* No tracking even with permission

* No tracking unless the user mailed you hard-copy permission

* No popups

* No popups unless user testing shows that a user who hates popups, doesn't care about privacy and is just clicking stuff to get to see the site, will decline tracking at least 80% of the time