And on iOS? Which is maybe what they're using

Violating gdpr is apparently legal. But even having opt out instead of opt in is in violation

Yes. But it is not enforced. The largest Dutch tech website is not GDPR compliant.

Core77 doesn't do any business in the EU, so it probably isn't a concern. There's a few states in the US with cookie banner requirements, so it was probably designed around that.

Good luck trying to get the cookie laws enforced in any way. The Dutch DPA, for example, only lets you submit a GDPR complaint and get a response on things that directly relate to your own data. Otherwise, you can only submit a "tip-off" that they'll "review" but won't respond to.

GDPR/ePD also requires "reject all" to be a single button, and asking the user to click a billion separate "reject" toggles is against the law, but many sites don't care.