actually you also don‘t always need a cookie banner (not mandated by GDPR) and being compliant is not as difficult as many consultants (who want to make money) say it is.
Still even though the idea of GDPR was great, but they didn‘t think about good and easy implementation. Which sucks and I understand the frustration.
But the GDPR and ePrivacy directives don't protect us from nefarious cross-site tracking cookies.
Prior to the GDPR, websites just tracked us.
Now they track us AND present an irritating warning that users have learnt to mindlessly "accept"
Legal professionals live in a different world to entrepreneurs - with diametrically opposed priorities.
Yes it is unnecessarily complex, but as I said: there is so much BS floating around. In reality if you have goodwill and yes invest a little time it is not that hard to be compliant and in praxis if you are not: usually there is the concept of warning before fining, so you do get a second chance.