[broken-kebab]

I think cookie consent is a different story. GPC would mean: "Under the GDPR, the intent of the GPC signal is to convey a general request that data controllers limit the sale or sharing of the user's personal data to other data controllers".

It doesn't preclude a website from storing cookies, and therefore doesn't relieve it from the obligation (at least in the EU) to show an obnoxious popup

[bad_user]

Under ePrivacy, websites only need to show a cookie banner when they are doing spyware shit. There are exceptions to this, but generally speaking you don't need a cookie banner for functionality that the user expects. As one example, you don't need a cookie banner for a login cookie or for storing the user's preferences.

While the law has flaws, it's very frustrating to see people misinterpreted it, instead of reaching the correct conclusion that the vast majority of websites are spyware. And that it's not EU's law to blame, but rather standard internet practices related to analytics and the serving of ads.