The law isn't poorly implemented. The way websites deal with it is. Just don't set any cookies for a read-only visitor and you don't need to add any popups.
It's both. The law itself is poorly thought-out and overly restrictive. And then websites also don't understand it and do stupid things in the name of compliance, which are neither compliant nor beneficial to the user.
"Make a fraction of the ad money you'd have had with targeting and you don't need any popups" doesn't help people running non-hobby websites put food on the table.