[shagie]

As a company, if I were to implement something that is unknown to be in compliance with the spirit or letter of the GDPR, it is possible that the company would get sued within the EU.

The way to ensure that you don't get sued is to copy the structure of the one website that you know is in compliance with the GPDR and follow their lead.

When reading the GPDR text from https://eur-lex.europa.eu/homepage.html I see a cookie banner. If it works there and that is the example of how to be in compliance with the obligations of a website for cookies? Would some other implementation that isn't done that way be risky in that the courts in Europe could decide that it wasn't done correctly?

Until the websites of europa.eu change to show an alternative way to be in compliance with cookie notification for the GDPR, banners remain the least risky (and yes, easiest and laziest) way to try to remain in compliance.

Nothing in the GPDR says "thou shalt have a banner" - but that's not the issue at hand. What is the least risky way for a company to implement the requirements of GDPR given that's the way europa.eu does it?