Ha! Just because you're only getting flack for this, I once upon a long ago worked on gdpr implementation and it was exactly the same thing.

Our entire team was working overtime and liaising with regulators to figure out what some of those pretty vague statements actually meant when it came down asking user permission for third party analytics and how to ensure we were compliant (what counts as essential, how many non-essential can you reasonably ask someone to review, who creates that list, what happens to the companies not in it, etc.etc.).

Nobody else knew either because they were all looking at us, as we'd be likely to get sued first anyway. Cue the articles after launch on how we either didn't care to do it right or we were actually being our usual evil selves in sneakily not implementing it in properly.

I feel your pain