It's like they saw how annoying the existing "cookie laws" were and said "we can make it worse!"
GDPR might have had good ideas, but the implementation is so botched it's not even funny. Everything related to cookie consent should have been standardized and delegated to browser settings.
Rather ironic to say this when the entire reason this stuff has been needed is that Google, which has monopolized the browser market, is an advertising company whose core business is tracking people in the first place and does everything in its power to obstruct anything that weakens it.
It had a very significant impact privacy, worker rights and such.
So exactly how is that later part of selling data and gathering it unnecessarily supposed to be avoided if not by regulation like GRPR?
Maybe it is just entirely different people, but there must be some overlap.