Sloppy, non-privacy-preserving "analytics" set up by some communications intern ≠ malice. They can mean well and still do a poor job. True privacy on the internet is notoriously hard.
Sorry, no. Code doesn't magically go from the intern's workstation to live. If the chain of incompetence is that long, then the most generous read is that they don't care
Could've been as simple as installing and configuring some off-the-shelf "analytics" and "cookie banner" plugins for their content management system. Unfortunately, the chain of incompetence is that long, because these orgs do not attract talent that understands these things.
One of our sites that don't use any kind of tracking or cookies other then a site preference cookie, got so many complaints that we had to put up a cookie banner that simply says "we do not use any tracking cookies"...
Users complained that we were non-compliant with EU regulations due to the missing cookie banner.
Because of the legal wording of these support tickets, the support team would often raise them to dev or legal as well, and since this is a non-revenue driving part of our business (the reason we don't track in the first place) we decided to just put up a cookie banner explaining why we don't need a cookie banner.
Literally the point is that sites are showing the banner by default practice even when they are not tracking. You understand this!
Your kind comes into every one of these threads and says some version of "well if they weren't tracking then they'd have nothing to worry about and no need to show a banner", but that is so obviously not true to anyone who uses the web. You absolutely do not need to defend a law that is not working.