The EU law doesn't specify the mechanism used to inform the user. If you look around at different websites, several mechanisms are used, some more obnoxious than others. Popups are the worst user experience of the lot.