One of the reasons GDPR was enacted is because the cookie law wasn't taken seriously. Companies used technical means (removing any meaningful opt out) to render the law moot in practice; as the industry failed to self regulate, the EU took the nuclear option.