The EU tries to rope off a single building with velvet ropes, a doorman, ID verification, facial scans, and cookie banners, while next door it's an illegal rave in an abandoned supermarket.
The real issue is that there aren't a whole lot of consequences when it comes to tracking data. It's a legal violation, sure, but it's not a criminal violation. So it would be up to you to pursue it. In many countries you can't even file a civil lawsuit, but rather, you have to go through your national data protection agency. Which in reality likely means your complaint will be auto-rejected after five years because they need to clean up the queue.
As far as the malicious disobedience goes... well... it's probably because "all the other website do it", but you might as well just give people the option to go to a setting to turn it off. It's not like that would be any less of a legal violation than the banner.
Don't know if it was intentionally positioned like that but I was ready to imagine it was.
I do wonder what would have happened if the laws were in place first. Would people have been so willing to add all this stuff if it meant putting a big thing over the entire shop?
My other consideration is whether if the owners had to use their site like new customers every time if they'd get pissed off about the stuff covering their actual shops.
In either case, I think the net result is bad news for users, good news for people selling things. And of course the sprinkle of "people just making mistakes/guesses" too, but there's no universe that's not going to be found.
The EU's own government websites are littered with the obnoxious cookie banners [1].
It's an unbelievably thoughtless and misguided law that has unfortunately ruined the internet. I think a lot of people rightfully blame the EU and they're terrible lawmaking for this nonsense.
They didn't want user data to be sent to third-parties without consent, so they created a law that made it mandatory for web pages to ask for consent to send the data. Most web pages need to send data to third-parties to be profitable, so they need to ask for consent.
What would the next steps be like? The purpose of the law is to give users the power to consent or not consent. In other words, I can pay for the contents of a web page with my data. Removing that option from me doesn't give me power to do whatever I want with my data: it takes that power away from me instead. That would be bad.
Is that true? If so, it's a sad state of affairs.
Runner up: 1-click reject all mandatory
Because it is not the means, it is the intent that the GDPR tries to protect you from. The GDPR (and EDP) says that tracking, any tracking not just cookies, requires the consent of the tracked one.